Here's what makes it harder: employees aren't failing because they don't know better. They're making conscious trade-offs, choosing speed or convenience over security when the two conflict. Training people who already know the right answer doesn't fix that. Measuring and responding to behavior does.
The threat landscape has also changed faster than most awareness programs can adapt. GenAI has turned social engineering into a scalable, personalized, multi-channel operation. Deepfakes, voice phishing, Teams and Slack impersonation, the attack surface your training was designed for looks nothing like the one your employees face today.