Do You Create Stupid Users?

Most security awareness failings are actually failings of security programs.
A week doesn’t go by where we read about some attack that is precipitated by bad user actions. At a specious level, it appears that it is another case of a stupid user doing something that they have been told time and time again not to do. Clicking on phishing messages are one example of that.
However, when I hear the stories, I always ask myself what could have been done differently on the part of the organizatio