Most phishing training doesn't work because it's generic and deadline-driven. Real security needs organizational culture change and habits built into daily work, not just periodic simulations and online courses.
And my issue with cyber awareness was a lot of times that alluded to we are pushing out education and giving people tips and tricks, but it really wasn't changing behavior. So from my perspective, like human risk management is more comprehensive. We're actually getting into some of the topics like organizational change management. We're building a culture internally. We're creating actionable assignments or things that employees or work groups need to know and do and build into their work pattern. So for example, you know, a lot of the industry has really pushed the ethical phishing testing quarterly, monthly, whatever you do, and then some sort of online training. And it's gotten better with more creative content, but at the end of the day, it's still computer LLM messages that go out. You have X days to do your assignment, and that's a tough pill to swallow for a lot of really busy employees.
