Most breaches start with a human decision, not a hacked server. Here is what effective security awareness training looks like, and what to avoid.