A security awareness program should:

present top management's perspective. 

address details on specific exploits. 

address specific groups and roles. 

promote security department procedures.