Organise regular table top exercises

Security incidents must have serious consequences for the people who are responsible to keep everybody alert and engaged

Have read team vs blue team exercises once a year

Run periodic awareness campaigns