From what my experience in cyber seem to validate, the below recommendations have been really helpful in building a "culture of security", a culture where all employees understand their individual role in protecting company assets, and feel empowered to communicate security issues without fear.
Increase the visibility of the security function and rebrand as a partner
It is unfortunate that security folks like ourselves are often associated with a culture of no. We are seen (wrongfully) as adversaries to be feared / avoided and as opponents of change, rather than partners with the business to increase value. The cybersecurity function is often seen as "the police", only there to enforce laws, without understanding of user needs.
Therefore, I would suggest first rebranding the security function as a friend to the business. End users may not know what security does for a company or how it brings value, given we are often a cost center, not a profit center. They may just see the negative aspects of security manifest, if not implemented well and thoughtfully, or implemented excessively (i.e: security nazi) Find ways to interact and get to know your end users and really listen to what their needs are. Show them you actually care about what the cost of new security controls are to their job.
Ensure end users understand the purpose of corporate security training
Unwillingness of the end users to adhere to security training might be due to them not understanding why certain processes / procedures are the ways they are. E.g: We, as cybersecurity professionals, may understand the role of DLP in mitigating data leakage, but a non - technical end user may just be annoyed when an email they sent is blocked, and they are forced to use alternative (and possibly unfamiliar) means to communicate. As to how to communicate to end users, this answer raises several excellent points, two that will highlight below.
Target the security training to end users based on specific, relevant security risks to their job duties, in addition to providing a foundational level of training that all users get
Recruit colleagues to form a cybersecurity advocacy / champion team. Rather than management enforcing training from above, now a continuous message about security is coming from their peers, who also serve as a source of support when end users have questions about IT security processes / expectation of them.