Security training improves security but it doesn't get close to stopping 100% of attacks.

I know it's obvious, but it feels like it's only obvious to those that think about security. It's the same reason that putting your developers through a yearly OWASP Top 10 secure coding course isn't going to get you to 100% secure code.

Locking down systems seems draconian, but it's the only way:

- Disabling USB storage

- Moving away from passwords to hardware authentication

- Strong controls on internet access

- Stop incoming calls from reaching most employees. Better: take away phones altogether

And so on.