Security awareness

Training helps. It cannot be the control.

Raising the floor is genuinely worth doing: more people spotting more things is better than fewer. But no organisation should be designed so that safety depends on every person identifying every attack every single time, because that is not a standard anybody meets. The measure of a good system is what happens when somebody does click. If one mistake by one tired person on a Friday afternoon is enough to cause a serious incident, the problem is the design, not the person.