Respectfully disagree, here. Infosec has been trying the education path for decades, now. It&#x27;s not working. Either something needs to change about the educational process, or acceptance that it&#x27;s failed is warranted.<p>I think fixing development will be more optimal than fixing users. There is no legitimate reason that OWASP top ten or lack of buffer bounds checking should still be in the wild in 2016, whereas users will always fall for scams, phishing or otherwise.