The Debate on Security Education and Awareness

This blog post by David Kennedy argues that security education and awareness programs are essential to building a security-driven culture, presenting practical examples from enterprise experience and countering Bruce Schneier's claim that such training is ineffective; it emphasizes regular communication, user-focused basics, and culture change as high-return investments rather than technical prevention alone.