Six months after launching a security awareness program, the information security manager reviews simulated phishing results. Overall click rates have dropped, but a small group of employees repeatedly fails the simulations despite receiving the standard annual training. What is the MOST effective action for the security manager to take?