Security programs imposed on unwilling users without regard for their experience get circumvented like any bad product. Treating the program as a product — with users whose adoption you have to earn — produces controls people actually use.
“A security program nobody wants to use is a product that failed.”