Security training should prepare people for the moments attackers actually create, across every channel they use. The wrong starting point is treating employees as a risk to be mitigated. Preparing them as the last line of defense, and actually equipping them for that role, is a different task entirely.

When someone clicks a phishing link, the response inside most organizations follows the same pattern. There's the incident report. There's the remedial training. And underneath all of it, there's an assumption that rarely gets questioned: that a smarter, more careful person would have caught it. That assumption is wrong, and it's expensive.

Most security awareness platforms were built with compliance in mind, not learning. The goal was to get everyone through the content and generate a completion report. Role-specific delivery was an afterthought, if it was a thought at all. That made sense when attacks were more uniform and when the tooling didn't exist to do anything more sophisticated. It doesn't make sense now.

You start the module. You realize it’s going to take a while. You half-pay attention for a minute, move it to the second monitor, click through the quiz, and get back to work. Whether any of it changed anything is a different question. That disconnect is why we need to start thinking about security awareness metrics differently -- because so much of this category is built around proving the training happened, not proving it did anything.

Claude Code, Codex, Copilot, and a growing pile of no-code tools have democratized software creation. An employee can have something functional running in minutes lunch. Something that handles critical data, sits on the internet, and makes decisions about permissions and access that used to belong to people who understood what those decisions meant. What does that mean for your security program?

As the MGM breach demonstrated, traditional security awareness training has failed to keep pace with modern attackers. They now use hyper-personalized emails, phone calls, and AI-generated messages to bypass the red flags employees were taught to spot. The industry needs to evolve.