The most common misconceptions in my experience:

“Why do I care? I’ve got nothing to hide and they have all our data anyway.”

“Isn’t open source less safe if everyone can see how it’s made?”

“Email is safe because only I have the password.”

I’d debunk those and give examples and tips. I’d also briefly tell them about the concept of social engineering and what to look out for. And if there’s time mentioning password managers couldn’t hurt.