This is a great point. Normalising good security behaviours is hard to do, but important. An old workplace had a great culture around checking ID of anyone you didn't recognise (necessary as they handled a lot of sensitive material), and at my current workplace we regularly run phishing simulations and encourage people to share them in Slack to keep it front of mind (as it's one of the biggest risks we've identified).