I don't want my users to be clueless. I want them to better understand the technical systems they use every day so they can employ them more effectively. But they and I have a job as well. When I was in tech support, I spent hours some weeks with one particular user working on her software and teaching her more effective use of her computer. But I could only do that during slow weeks: I didn't have enough time to do that every week, and I certainly couldn't do it for everyone in the building. If we'd wanted to teach the whole building how to use computers, we would've needed probably a good quarter of the employees teaching other employees, during which time those employees under training wouldn't've been able to perform the work they were hired to do. We tried making documentation for users to read, but while you can lead a horse to water, you can't make him drink.

But ultimately, while I always wanted people to take training courses in computer use, I still implemented security measures, because I knew that people were at the company to work, not to take training courses. I want security measures in place for the same reason I want computers in the first place: so that I can let the computer worry about it for me. I don't want to have phishing awareness campaigns when I can just make the spam filter more effective. I don't want to tech people not to click the flashing greed download button when I can just roll out an ad blocker across the entire organization. I don't want to send an emergency email blast to my coworkers telling them not to download TOTALLY_NOT_A_VIRUS.PDF.EXE from the chain email going around and keep one step ahead of the mixture of malice and idiocy out there when I can just set up a system to scan email attachments for viruses in the first place. Yes, I want a more informed and educated workplace, and I worked to make that happen, but I want computers to work for me and do the hard part for me as well