text: It’s mentioned elsewhere in the replies, but it’s important to note that for a company — particularly a large public company — worker training is a critical part of the, yes,  security theater, put on for regulators who will judge the adequacy of your program in hindsight after an incident.