[Jiggly]

but they can only do so much if the end user decides to do something stupid.

Absolutely.

A device Is only as secure as the person who operates It. Users need to be cautious with the "Task" they're performing.
T= Training.
A= Awareness.
S= Skill set.
K= Know-how.

And In a corporate environment, a lot of the above comes from the lack of company policies to educate their employees.

Holy crap, I didn't even realise this was a possibility. It seems obvious now but I'm sure I've made these mistakes somewhere along the line.

Ironically I have to create a policy brief for a class project, it would be amusing to see if I could use this as a suggestion for mine xD