When I've been asked to setup some presentations about security awareness, I've always used something that is familiar to the user base to demonstrate weaknesses that can be exploited.
Let's take a simple organization, Acme. Acme has about 200 employees, a robust IT infrastructure, top-of-the-line firewalls, secure applications, a smart CISO, etc. Their wireless is WPA2 with RADIUS Auth which uses the user's AD credentials. They also use Outlook Web Applications (OWA) a lot.
If this was an organization I was demonstrating an attack to, I would first set up a phishing site that looked just like the OWA installation. It's ridiculously simple to do with something as accessible as wget, or you could use Trusted Sec's Social Engineering Toolkit to set it up. Once you do that, change the login form so that the username and password entered goes to your own database/file store—or, you can once again use SET's credential harvester. Optional: Buy a domain, such as acme-corpwebmail.com or something like that.
The next thing to do is send a sample email to yourself. It can be something along the lines of how there's an IT upgrade and people need to validate their accounts—focus on the email being believable, with good English, something that can be trusted, even. Log in with the credentials, and show that they get captured.
Use the same credentials to log in to the corporate network (since it is AD credentials after all). Now an attacker has access to everything an ACME employee has access to, and he hasn't even broken an application or entered the building. He can be sitting outside the parking lot the whole time.
Want the extra effect? Make this whole thing a really cool video. It's not hard to do, even if it takes a little extra time.
Once you show how an attacker can get in, focus on what the employees need to do to protect themselves—i.e., make sure that the email is from who it claims to be from. If in doubt, ask the person if they sent an email—it's okay to waste the person's time if it means being safe. If the link is external to the organization, ask the person/the security team before clicking on it. If it is external and asks credentials, assume it is malicious unless told otherwise.
From personal experience, I can tell you that this has been very effective—it makes an impression on people, even if it builds paranoia in some—and a certain level of paranoia is always good. :)
If you want to take it to the next level, I really do recommend checking out what SET has to offer. Dave Kennedy and all the others who have worked on it have done an absolutely amazing job on the tool, and it provides all the tools necessary to teach people about social engineering.