The five most common pitfalls of cyber security awareness training