There is only so much you can do with training, especially when there are no (perceived) consequences for not following the rules.
We in the security field need to come to terms with the fact that people have better things to do with their time than follow our silly rules, most of which they don't understand and any consequence for the user is so delayed (hours, weeks, months) that the majority will never learn. It's pure psychology and we seriously need to take a clue from what the last 60 years of marketing/spin/manipulation has taught us about the human brain.
Your best option is to manipulate your way to success. Whatever you're trying to get your users to do, make your secure way the easiest/fastest/cheapest way. Users skip security advice because it can save them 2 seconds, so reward good behavior whichever way you can.
Example: Many years ago, I was in an organisation which suffered from users picking the same passwords across many systems and these systems accepted telnet-access from anywhere. This was exploited by attackers on more than one occasion.
Killing telnet and going to ssh with key authentication solved the security problem and removed the need for users to type in username and passwords on every remote connection. Having to not type their password for every new connection made it OK that they had to unlock their ssh key with a passphrase every morning.