"Get Beyond Security Awareness Training" Does Not Mean Forgetting About It

This blog post argues that effective security awareness training and broader human risk management are critical to reducing cyber risk, given that social engineering drives the majority of successful compromises. It highlights spear phishing’s outsized impact relative to volume, warns about the dangers of password reuse between personal and corporate accounts, and emphasizes that education—along with controls like MFA—is often the primary defense where perfect technical controls do not exist.