We still issue speeding tickets instead of firing everyone at the DMV.

Educate all you want; no consequences, no behavior change. Incentives matter. Employee opsec metrics should be a part of corporate cybersecurity insurance pricing IMHO.