How to make security awareness stick in fifteen minutes a quarter: teach the pattern, use real examples, and celebrate the people who report.