how much staff training have you done?

Sorry, but you can train and write policies all day long. Some goober is still going to pull down an attractive but deadly malware payload because he received a loaded e-mail from his cousin's bot-infected home e-mail account.