I think you have hit the nail on the head when you say, "...not interfacing with our users very often"
You absolutely must work with the end users to understand their view - most end users have no interest in understanding what 0-day even means, let alone why they should care.
A lot of what I do is that interface between technical security teams and non-technical clients, and the best approach, in my opinion, is to sit down with the user and understand what their job demands of them. What are the easy and difficult aspects?
- As an example, do they have old laptops which take ages to boot? If so, you will find they will not want to do a full shutdown every night but instead may just hibernate their machines. Which will obviously break the protection offered by full disk encryption. So your essential security feature is wiped out despite everyone knowing it is valuable. The solution then requires liaison with more senior levels to articulate the problem, possibly referring to data protection legislation, and then with IT.
Do you understand the drivers for your users? If you don't talk to them, you won't - and by talk I really don't mean evangelising about security. I mean listen to them, listen to their rants about IT not working, listen to what they think they need to do as part of their day job, then go away and analyse what impact their drivers and aspirations have on your security aims.
Because at the end of the day in many organisations security is seen as a blocker, something that just stops people being able to work; and then when the organisation is hacked it is the security team's fault for not making them secure.
Awareness at grass roots level first - then build your security strategy to support the IT strategy and business strategy. Support at user level will make it much simpler to have security built in to improvement projects and BAU.