We are building a bibliography of InfoSec resources that address work groups, human threat assessment capabilities, and collaboration in InfoSec projects. Also applies to resisting disinformation and malware on social media sites.
Hi Eleanor! I worked on this arranging this podcast featuring Intel IT Information Security director Xochitl Monteon (https://connectedsocialmedia.com/16473/inside-it-strengthening-intels-security-culture/), who talks about the multiple ways Intel tries to strengthen security culture to resist things like phishing, to develop more security applications (much cheaper in the long run), and to function as a kind of human sensor as part of a greater defense in depth strategy. Techniques include:
setting up a security college
mandatory security classes
Phishing and other malware education/awareness campaigns
I also suggest you look at some of the software for phishing education/simulation that is out there.
Also germane to this question is the work of BJ Fogg and his book "Persuasive Technology" (see this article - https://www.wired.com/story/phone-addiction-formula/ about the influence from just one of his classes). Also, I wonder if there is any relevant research about diversity and resisting group think and confirmation bias - sorry now references there.