It is very hard to make people who have never experienced a cyber attack threat the need for best practices, such as two-factor authentication, with urgency.

Most users will see best practices as an unnecessary burden they do not need. That is why those in the cybersecurity space need to empathize with the user while advising them.