Cybersecurity awareness training is about turning employees into the last line of defense—and a security vulnerability.