Security awareness: To train or not to train, that is the question