Critical thinking. The best security is useless if the user clicks the first crypto-locker posing as a harmless security update. That said, you can’t fix stupid. Some people are just destined to be fleeced by people with more acumen and less scruples than them.