Who should be able to opt out of security awareness training? The simple answer is nobody. What about the chief security officer? Nope. What about the director of IT management? Nope. And so on, and so on. Let’s ask this same kind of question in a different context. What NFL player should be able to opt out of practice? Should an NBA player be able to opt out of warm-ups?