... But my request to the IT security mavens would be to extend your rigor beyond the employees to the programs that directly contradict your rules themselves.
I am told strictly: NEVER click on a blind link, yet I get constant emails from departments - including IT! - that are LINKS to training videos, educational resources, mandatory bullshit that when if don't click on it, I get stern warnings that I'm not doing mandatory things. (Oh, and all external email urls are replaced with unparseable 200-character strings that supposedly route the link through "URL defense" or some such.)
Or how about all the consultants? I work for an EU multinational and we have at least 3 REGULATORY-required systems that I have to log into to comply with EU bureaucracy that are myCompany.kpmg.com or whatever - and then I'm supposed to give that EXTERNAL pop-up my *corporate* user and password while it authenticates through our corporate cellphones.
I'm reasonably savvy, I believe, but when policy & security rules contradict, which am I supposed to follow? I can tell you that corporate IT doesn't appreciate being shown it's own use of blind links.