A lot of engineers will hyper-focus on building some labyrinthine security system to try and thwart employees leaking credentials, but understanding WHY an empl

A lot of engineers will hyper-focus on building some labyrinthine security system to try and thwart employees leaking credentials, but understanding WHY an employee will willingly compromise their credentials is the true starting point. Phishing attempts may seem obvious to the tech-literate, but the average office or call center worker is probably more focused on pleasing their manager or not hurting their customer feedback rating than focusing on security. Maybe employees don't know about where to direct security concerns? Maybe they've had a negative interaction with the IT/security team at some point in the past? At a previous employer the security team would periodically send out a wave of phishing attempts to employees to see how they would react.