Isn't training just blaming employees for security failures?

Quite the opposite. Good awareness training supports people, it doesn't punish them. The aim is to give your team the confidence to spot and report threats, and to build a culture where reporting is welcomed. We never trot out the 'users are the weakest link' line. People are the layer that catches what the technology misses.