The 4 most common mistakes in employee security awareness training