An information security manager reviews incident data and finds that most recent breaches originated from social-engineering attacks targeting system administrators and other privileged users. The organization already runs a uniform annual security awareness training program for all staff. What should the manager do FIRST to improve the program's effectiveness against this trend?