I do a fair amount of security awareness training, and people usually need to get burned a few times before they make a change. Security awareness is like exercise -- you have to keep it up to benefit from it.