End users should be expected to care about security. They should not be the only guard rail, but they are part of the defense in depth plan.

You do know about all those security training courses HR makes your take every year that you skip over?