[lordfrito]

Regarding shaming: A new strategy I've noticed recently is that my organization randomly deploys emails from time to time that are basically "fake" hacking/phishing attempts. Sometimes it's a PDF link, or a request for an invioce, need a phone call, etc.

If you fall for it (clicking the link) then you get sent to a webpage saying "Hey this was a test and you fell for it... think twice before you fall for this again. Please watch this short security video". Then you get followup emails until you finally get around to watching the video.

Something tells me if you are a frequent offender they have you do additional training.

As annoying as the emails are, I appreciate that this avoids the shaming aspect. Its important to keep the normies on guard against this kind of stuff. And this gets the job done without drawing attention to human level failures. And it keeps everyone a little more on their toes.