They do if they are employed in a non-tiny company where they work at least partially on a computer and paid attention during security training.