Social engineering is cited as one of the primary threat vectors (see for example at: https://gallery.technet.microsoft.com/Fixing-the-1-Problem-in-2e58ac4a). Employee awareness training is also cited as one of the best means to mitigate this threat (see the same paper linked above).
My company has a 20 minute computer-based training module on social engineering awareness and prevention that is delivered once per year. But I am a computer security guy and I have trouble remembering what it said, so I question its effectiveness.
Is there any industry awareness or consensus on what constitutes an effective social engineering awareness program? If so, what are the features of such a program?