Security

And the training is bad. No one pays attention to know before's bullshit click through EULA of a trainer.

People pay attention when engaged. Bring them to a meeting, have people compete to find fakes. Games work. Rewards work.