Very true. However, end-users are closer to potential problems and are often the first to identify security incidents. The goal of an awareness program is often to change attitudes to technology and to help employees appreciate the value of the data and technology they are using. And this takes time and repetition. As you rightly point out, it only takes one employee to ruin all the hard work. At the same time, though, I would prefer my risk to be limited to that one employee, if the remaining 49, for argument’s sake, are alert and aware of the consequences of their actions. Long-term, I believe, there is value in having an educated and alert workforce.

Thanks for your comment.