Re: Dont' name and shame persistent offenders
Then they just obey the security policy to the exclusion of doing any work.
If you do those fake phishing calls/emails to see if they respond then your users stop responding to any calls/emails - they can simply claim they thought all customers were suspicious.
In fact I'm not even logging onto my machine this morning because the keyboard looks like it has been moved on my desk - that's "suspicous" so I'm going out for coffee until IT have checked it.