What's weird is that at my org we have all the security theatre and regular password changes and training videos you have to watch every month, and I just assume people ignore the training because it's obvious stuff. It's clearly not obvious stuff to some folks.