Founder and CEO at CYFIRMA, overseeing the business strategy, product roadmap, growth & expansion plan, and investor relationship.
October is Cybersecurity Awareness Month, and most organizations will mark it the way they did last year: new posters, a refreshed e-learning module and another reminder not to click suspicious links. The intent is sound. The content is not. Most awareness programs teach yesterday’s attack methods to a generic employee, while adversaries prepare tomorrow’s attacks against specific people.
When I led cyber intelligence at a national intelligence agency, training was continuous and built on what we knew about our own weaknesses. Every briefing started with three questions: Which of our assets were exposed? Which of our routines could be exploited? Which weak spots was the adversary already probing? We trained on real exposure, not hypothetical scenarios.
Few enterprises work this way. An adversary targeting a company does not study “phishing” in the abstract. It studies that company’s weak spots: the unpatched VPN, the help desk that resets passwords by phone, the supplier with privileged access, the finance team that approves payments by email and the executives whose voices are public on earnings calls. Most awareness training addresses none of this. The CFO, the help-desk analyst and the contractor with domain admin rights all complete the same generic module.
Generic Cyber Training Is Not Working
The evidence is consistent. The 2026 Verizon Data Breach Investigations Report (DBIR) found a human element in 62% of breaches, and the FBI recorded nearly $21 billion in cybercrime losses in 2025.
Training is not moving those numbers. A UC San Diego Health study of about 19,500 employees found no meaningful link between completing annual training and falling for phishing. What mattered was relevance. A generic password-update lure fooled 1.82% of staff, while a lure about the organization’s own vacation policy fooled 30.8%. Context made the attack 17 times more effective.
Attackers personalize. Most defenders still generalize.
Show People What The Attacker Already Sees
Every serious campaign I have tracked began with weeks of quiet reconnaissance, and the targeted organization was almost always the last to see what the attacker had found: employee credentials for sale in infostealer logs, look-alike domains imitating the company and its suppliers, fake executive profiles used to approach staff and partners, job postings that reveal the technology stack and earnings-call audio clean enough to clone a CEO’s voice.
Each of these findings becomes a pretext aimed at a specific person, yet none of it appears in that person’s training. Threat-led training closes the gap by putting what the attacker already sees in front of the people who will be targeted.
Brief People On The Adversary, Not A Category Of Threat
“Beware of social engineering” is a warning, not a briefing. A real briefing tells people who is likely to target them, how the approach will unfold and what the attacker needs them to do.
The 2023 attack on MGM Resorts shows why this matters. Attackers found an employee on LinkedIn, called the IT help desk posing as that person and reportedly gained account access in about 10 minutes. The incident cost MGM an estimated $100 million. At Arup, a finance employee transferred about $25 million after a video call in which the CFO was a deepfake. In neither case would a generic module have helped. A briefing on that exact pretext might have.
Threat-led training answers six questions for every organization:
1. Where are we exposed? (Leaked credentials, internet-facing systems and unpatched weaknesses.)
2. How are our brand and identities being misused? (Look-alike domains, cloned login pages and fake executive profiles.)
3. Who is targeting us? (Threat groups whose interests match our sector, region and technology.)
4. How do they operate? (Their current pretexts, tools and sequence of steps.)
5. Which paths can they take? (Weak internet-facing assets, informal processes and the contractors and suppliers that can move money, reset identities or touch production systems.)
6. What do they need from our people? (A password reset, a payment, or an approval, and the one action that stops them.)
What CISOs And Technology Leaders Should Do Next
• Connect Threat Intelligence To Awareness: Give the team that runs training direct access to external threat intelligence and, using the visibility, make it as a source of training material.
• Prioritize By Attack Path: Start with the people on the most exposed and most targeted paths: finance, the help desk, executives and their assistants, HR and privileged IT users.
• Include The Extended Workforce: The DBIR found third-party involvement in 48% of breaches, up 60% in a year. Bring contractors, outsourced service desks and critical suppliers into the program, and write threat-led briefings into their contracts.
• Refresh As The Threat Changes: Update briefings and simulations when adversaries change tactics, not on an annual calendar. A briefing that arrives after the campaign has moved on is history, not preparation.
• Measure Resilience, Not Completion: Report to the board on how quickly people flag realistic simulations, whether the help desk holds to identity verification under pressure and how fast exposed credentials and impersonating assets are removed.
Answer The Adversary’s Question First
Compliance asks, “Did everyone complete the course?” The adversary asks, “Who here will reset a password, approve a payment or authorize an app for me?” This Cybersecurity Awareness Month, start with the adversary’s question.
AI has given attackers a real advantage. The 2026 DBIR found that the typical threat actor now uses AI across 15 attack techniques, from researching targets and writing fluent lures to cloning voices and faces. Campaigns that once took weeks of planning can now be run against specific people at speed and scale.
Leaders responsible for cyber awareness and training must respond in kind. They need to build external threat intelligence into their programs and make sure every employee, contractor and third-party training is relevant, personalized and threat-led.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
