What exactly would you train them to do? It has to be comprehensible by laypeople and distilled down to a single mantra. So many security related interactions

What exactly would you train them to do? It has to be comprehensible by laypeople and distilled down to a single mantra. So many security related interactions have backfired already, like this one. Is there one simple, straightforward principle that users could follow that will always work, and will keep working long into the future? I doubt it.