text: You may be right that it can’t be proven to drive security outcomes, but the lack of evidence of consistent worker training regarding social engineering is a big problem for a company that gets owned in a phishing attack and then finds itself on the business end of an FTC civil investigative demand.