Telling people to “be careful” once a year doesn’t change what they do when a message looks perfect, a voice sounds familiar, or a request arrives through exactly the channel they expect. What helps is practice: the chance to recognise something suspicious, verify it, report it, and hear back what happened. That’s the whole idea behind Behavioral Defense Engineering – employees are part of the solution, not the problem we’re trying to patch.