A very common and easy way for attackers to get your PII is social engineering.
In fact, attackers can ask questions which can be totally irrelevant to you, but through which they can gain valuable knowledge on you. By collecting a lot of information about you, they can have enough information to bypass your security. It is imperative to take precaution and consider who and what you are talking with/to. As well as this, it is also important to be aware of other threats that exist, such as software that may potentially harm your computer, however, this does not directly apply to giving attackers your personal information.
Nowadays, cyber security attacks are not limited to computers. We use mobile devices, such as smartphones and tablets, daily, and by installing applications on them, you considerably increase threats for you and your company.
Cyber security awareness training cannot be accepted as a one-shot approach; it is something that you have to test your employees on daily. This can be achieved by providing them with live tests, such as a phishing threat, doing some social engineering on them and going though how they should react when they know their computers to be a threat to the entire company.