Security technology always offers only partial protection.
Companies have now recognized that employees often have to develop a corresponding awareness first. That sounds like „problem detected, problem banned“, but in practice it looks quite different. The approach is often exhausted in an annual awareness training and solidifies in the sequence to a purely formal process.
A goal-oriented method should be based on the practical work situation and support the employees, not burden.
And it should make it possible to measure whether the measures actually work. This only works if companies play through realistic scenarios with their employees that affect them and are very close to the daily work routine. Flexible and not just a rigid appointment in the year.