Rarely do I agree as strongly with a post as I do with this content from the team at KnowBe4.  Successful cybersecurity defense is rooted in an aware and engaged organizational culture.  An organization needs consistent and effective security awareness training, and that training needs to be accepted and adopted and placed into action by all employees.  Everyone in the organization has a role and a responsibility in the success of the cybersecurity program.

https://blog.knowbe4.com/cyber-security-is-about-culture-and-people-not-technology