For more than a decade, security awareness training has been marketed as the antidote to human error.