In reply to Idowu Williams.

The best way to incorporate these approaches into your company is by partnering with IT, Security and HR to embed awareness into both the Security program and employee training/awareness programs. We align it with our annual employee code of business conduct training to make them aware of their obligations to protect the company data/resources and with the security program around the ongoing phishing tests to give them real experience and when needed on-the-spot training on helping us reduce incidents through their actions. Then we also do security specific training based on job role so it's relevant to them and their job/processes. So seek the alignment across Security, IT and HR and go for general to specific to maximize the impact and make it relevant to each individual person.