Train by example

At last, a security policy that makes sense and harms no-one. It seems faux phishing emails are now being sent out to check how well trained staff are, and if they fall for it they get a tap on the wrist. This has to be one of the best security measures I've seen in a long time – do it now to your staff. They may not like you for it but in the long run they'll benefit.