How did he go about it? Giving a manager a report saying Foo and Bar are suck at security gives the manager good information on who needs training.

If he walked into a conference room and called them out by name, that would be a touch abrasive.