Standard phishing training doesn't work. Two security experts argue companies need custom programs that cover insider risk and AI policy, not just quarterly modules telling people not to click bad links. Real security requires everyone to feel responsible, not just IT.
95% of the focus of most awareness programs out there that aren't, you know, staffed with 2 to 3 people or plus is basic phishing training quarterly, sometimes monthly if you're getting a lot of it. Online training, like you mentioned, jammed into the LMS, starting to be more bite-sized, but it's still canned. It's not tailored to the company.
There's a lot of focus on, to your point, Aaron, the basic, like, social engineering and the clicking the phishing. But then I think what they're missing is going beyond that and like look at like insider risk or AI policy and certain things that are going to be bespoke or tailored to an organization. And you're really not getting the depth of education or what you want, like the so what there outside of like the table stakes. Here's what this is. Don't hit a phish. And so I think getting beyond and say, okay, if I want to educate my workforce and drive awareness or drive even just a sense of accountability that like it isn't just the responsibility of cyber IT to protect the organization,
