From helpnetsecurity.com
People click on links and attachments and will, unfortunately, keep clicking even if they should know better. They’ll click for the chance of winning a holiday, or even something as cheap as a $2 cup of coffee.
No amount of awareness training is going to eliminate every click. However, you can always raise the cost for attackers and reduce the chances they’ll reach their objectives. You can do this by building a path of maximum resistance, and that begins by considering how an attacker sees your company.