Therapist: And how do we teach users to employ good security practices every day?

Me: Send them phishing emails with software patches disguised as malware attachments so they will definitely click on it?

Therapist: No.