💯 & for the record, “awareness” is not an outcome, it’s a potential contributor along the way. Ask yourself what tangible behavior is important & what factors need to line up to make it happen. Sometimes awareness isn’t even required if you employ better defaults & usability.
If a piece of security guidance is hard for employees to follow, get curious about why. Often the blockers lie in usability, not awareness. Identify barriers and look for ways to meet them where they’re at.