With limited training time, how do you decide which security habits to teach every employee first? Can you share a time when a simple change in training or reminders prevented a real threat, and why it mattered?