There was a bank in Russia that hired a dude better known under a moniker "Pchela" to enforce use of pgp, and infosec in general.

He devised a plan under which staff is trained, tested, and punished for incompliance.

Once the whole of banks ~1200 people staff got certified, they set a deadline for enforcement after which anybody caught will be fired on spot.

The day after the deadline they spotted ~60 people in the bank sending plaintext, or replying to an unsigned email. And among them, one director level employee.

They had to fire them all, including a directress who went on trying to suing them for years.