researching best practices in non-federal security awareness training is frustrating because there's never a definitive answer to anything

it's all just a sales pitch at the end of the day jfc