An оrgаnizаtiоn intrоduces а training program explaining how phishing attacks work and how to recognize them. After the training, employees agree that phishing is a serious and likely threat, yet many still do not change their behavior because the recommended protections feel inconvenient and difficult to carry out consistently. Using Protection Motivation Theory (PMT), which explanation best accounts for this outcome?