Tying rewards to safe choices really lands, because people respond faster when they feel seen for doing the right thing.
Make the easy path secure and let power users move without needless hurdles, while keeping guardrails clear>
Its the carrot that gets clicks out of phish, not just another boring slide deck.
Your right that small, frequent messages beat a once a year training.