I would consider user training as part of mitigation, where it doesn’t necessarily reduce or transfer the risk, but it aims to reduce harm. While training is definitely needed and is helpful in reducing harm, it is not as impactful…   Read more»