Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Companies Use Security Awareness Training to Reduce Breach Risk
Transcript
- Lucas: So the Verizon Data Breach Investigations Report for 2025 dropped a number that should make every CISO sit up straight: sixty-eight percent of breaches involved the human element. Not a zero-day exploit, not a sophisticated nation-state hack — someone clicked something, reused a password, or fell for a social engineering trick. Luna: And that's been pretty consistent, right? The human element has been a top factor for years. But I feel like the conversation around security awareness training has shifted recently from 'we have to do this for compliance' to 'we actually need this to reduce risk.' Lucas: Exactly. For a long time, security awareness training was a once-a-year slideshow with a quiz at the end. Employees hated it, security teams checked a box, and the actual behavior change was negligible. But now, companies like KnowBe4 and Proofpoint have built platforms that use micro-learning, simulated phishing, and behavioral analytics to actually change how people act. Luna: And the data seems to back it up. I read that organizations with continuous training programs see up to a seventy percent reduction in successful phishing attacks over twelve months, compared to those that only do annual training. Lucas: Right. And that's the kind of metric that gets a CFO's attention. Because every successful phishing click can lead to credential theft, ransomware deployment, or business email compromise — and the average cost of a BEC attack is something like one point two million dollars now. Luna: So how do these modern platforms actually work? Is it just more frequent phishing emails? Lucas: Not exactly. The better ones use a kind of spaced repetition model. You get a short, targeted lesson — maybe two minutes on spotting a suspicious URL — and then a simulated phishing test a few days later. The system tracks who clicks, who reports the email, and who ignores it. Over time, it builds a risk profile for each user. Luna: So they're basically using the same techniques as Duolingo or language-learning apps — short bursts, regular testing, personalized feedback. Lucas: That's exactly the analogy I use. And it works. Proofpoint found that users who complete four or more training modules per year are sixty percent less likely to fall for a simulated phishing attack than those who do just one. The key is frequency and relevance. Luna: But there's a tension here. I've heard from employees who feel like constant simulated phishing tests create a culture of distrust. Like, 'my employer is trying to trick me,' rather than 'my employer is helping me stay safe.' Lucas: That's a real concern, and it's something the better programs address. First, they're transparent about the program — you know you're going to get simulated phishing, and the goal is learning, not punishment. Second, they reward good behavior. Some companies give small bonuses or public recognition to employees who report suspicious emails consistently. Luna: And there's also the question of content. If the training is condescending or uses unrealistic examples, people tune out. The best programs I've seen use real-world scenarios — actual emails that hit the company last quarter — and explain what red flags to look for. Lucas: That's a great point. And it ties into a bigger shift I'm seeing: the rise of generative AI to personalize training content. Instead of a generic module about phishing, an AI can generate a scenario that's specific to the user's role — a fake invoice for someone in accounts payable, a fake executive request for someone in HR. Luna: So the training itself becomes more realistic and more engaging, because it mirrors what you actually see in your inbox. And that should lead to better retention and behavior change. Lucas: Exactly. And we're seeing early data from companies using ai generated training that suggests click-through rates on simulated phishing drop by an additional twenty to thirty percent compared to static, one-size-fits-all content. Luna: I want to push on the ROI question a bit. For a CISO trying to justify budget for a security awareness platform, what numbers do they bring to the board? Lucas: Great question. The most compelling argument is the cost of a breach versus the cost of training. The average cost of a data breach last year was four point eight million dollars, according to IBM. A good security awareness platform for a thousand users might run fifty to a hundred thousand dollars annually. Luna: So if it prevents even one successful phishing attack that would have led to a breach, it pays for itself many times over. Lucas: Exactly. And there are secondary metrics: reduced help desk tickets for password resets after phishing, faster incident response times because users are reporting suspicious activity instead of clicking, and lower cyber insurance premiums in some cases. Luna: Insurance companies are actually starting to ask about security awareness training during underwriting. I've heard that brokers now want to see proof of a continuous training program, not just a one-time certification. Lucas: Yeah, that's become a factor in the last couple of years. And it's another reason why CISOs are paying attention. But I think there's a deeper cultural angle here — the goal isn't just to avoid clicking malicious links, it's to build a security mindset across the organization. Luna: And that takes time. It's not a one-and-done thing. Lucas: Right. And honestly, that's why I find this topic interesting. It's not about buying a silver bullet — it's about changing habits and norms. And the companies that do it well see a real competitive advantage, because they're less likely to suffer a costly disruption. Luna: So if someone is listening and they're thinking about revamping their own training program, what's the first step? Lucas: Start with data. Look at your own phishing simulation results, your help desk tickets, your incident logs. Where are the biggest gaps? Then choose a platform that lets you target those specific behaviors. And don't try to overhaul everything at once — start with a pilot group, measure the results, and build from there. Luna: For me, it's about treating employees as part of the defense team, not as the weakest link. Lucas: Yeah, that's the right framing. And if these conversations are useful for what you're building or running, I should mention that we deliberately don't run ads on these shows. Luna: Right. It's a choice we made to keep the content clean and focused on the topic, not on selling you something. Lucas: If you'd like to support that, the link is buy me a coffee dot com slash fexingo. No pressure — just a way to keep it going. Luna: All right. Back to training. So we talked about platforms like KnowBe4 and Proofpoint — are there any other players in this space worth watching? Lucas: Yeah, a couple. One that's interesting is Hoxhunt, which started in Finland and focuses on gamified, continuous training with real-time coaching. Another is CybSafe, which puts a lot of emphasis on measuring security culture and behavior change, not just completion rates. Luna: And I've heard about companies using internal phishing campaigns built in-house with open-source tools like Gophish. That can be a good option for smaller teams with limited budgets. Lucas: Absolutely. The important thing is the program, not the tool. You can have the best platform in the world, but if leadership doesn't model good security behavior — like reporting suspicious emails, using multi-factor authentication — the training won't stick. Luna: And that's where CISO as a culture champion comes in. It's not just a technical role anymore. Lucas: No, it really isn't. The modern CISO spends as much time on communication and change management as on firewalls and endpoint detection. And security awareness training is one of the most visible manifestations of that shift. Luna: So if you're a security leader listening, what's one thing you can do tomorrow to improve your training program? Lucas: Review your last phishing simulation and identify the top three types of emails that fooled the most people. Then create a targeted micro-learning module around those specific tactics. Make it short, make it relevant, and test again in two weeks. Luna: I like that. Small, iterative, data-driven. Lucas: Exactly. And that's how you build a program that actually reduces risk, not just checks a box.