A large enterprise retailer engaged Kimly Hong to replace ad hoc awareness efforts with a structured, measurable security awareness program after phishing susceptibility rates and near-absent reporting behavior created sustained organizational risk. The twelve-month program delivered a phishing simulation lifecycle, a behavioral risk scoring methodology, role-targeted training across three workforce segments, and an executive reporting dashboard. Corporate susceptibility declined by more than sixty percent and employee reporting rose from near zero to above twenty-five percent. This case study documents the full program architecture, governance model, and lessons learned.