Many security awareness programs fail to deliver upon their promises. What can we do to make a real difference in our impact?