Most IT departments and by extension many Security teams have a major branding and marketing problem when it comes to security awareness and training.
It matters as much how you say something as it does what you say.
Also keep in mind, as other responders have alluded to, Awareness is not the same as Training and we should always remember that they go hand-in-hand.
I think it's important to first start with a strategy in mind of how you plan to connect with your target audience, who that target audience is, and what types if information they may or may not be receptive to.
From there, I think it's important that When you're creating or conducting security awareness and training that you have a few core values or pillars front of mind. The reason this is important because you always want to be consistent with your message. When you deviate or spread random ideas you find on the internet, that leads to misinformation, which leads to confusion, which leads to your messaging not maintaining consistency with what is actually important for your audience.
For me those pillars are:
Vigilance - This is emphasized by using consistent and reoccuring themes of reminding end users to always have a little bit of skepticism in the back of their mind when they are using the internet, email, etc.
Speed of Reporting - This is maybe the most important pillar in my opinion. I always stress, in everything I send out and piece of content I create, that it's vitally important that end users alert IT/Security/etc., of any suspicious emails, websites they may have visited, behavior in the office. Anything that looks or sounds or appears like it might be nefarious or suspicious, to please report it immediately.
Caution when Clicking - This is the common sense pillar you hear all over the industry. Think before you click, etc, etc. While tacky or cliche, it's solid advice. Encourage and reinforce with end users to take a few seconds and analyze the context surrounding that email or that link or that attachment or whatever the situation may be. Another good term for this might be situational awareness. Taken out of context a link in an email to reset your email password might seem benign. Until you realize it was sent from .
When i'm creating content, talking about security with end users, performing assessments or testing, I always always think about how my messaging is conveying these 3 things first.
Lastly, I think it's important to think about Security Awareness, like a brand or in the eyes of a media company. Newsletters and email blasts get boring. It's important to consider, like I said above, how you are communication just as much as what you are saying.
