Training programs provide the information, but security teams can reinforce these for better end-user education.