“Cybersecurity awareness training is not about creating cybersecurity experts. It’s about making staff and stakeholders aware of the threats and how to respond to them.”