In an era where digital defenses are more sophisticated than ever, the most persistent vulnerability remains the human factor. Dominic Jainy, a seasoned IT professional specializing in artificial intelligence and machine learning, brings a unique perspective to how organizations can bridge the gap between technical security and human behavior. This discussion delves into the critical failures of modern cybersecurity training, exploring why a vast majority of organizations still lack mature awareness programs and how the landscape of social engineering is being rewritten by AI. We examine the transition from simply meeting regulatory requirements to fostering a resilient culture that can withstand the high-pressure reality of 2026. The conversation moves through the necessity of role-based education, the evolution of the threat landscape beyond simple phishing, and the psychological readiness required for employees to report mistakes without fear.
How do we reconcile the fact that most security failures originate with people despite the massive investments in technology and sophisticated software?
The reality is that technology, no matter how advanced, cannot fully compensate for a split-second lapse in human judgment during a chaotic afternoon. When we look at the data, it is staggering to see that 62% of all data breaches are still rooted in human missteps, such as simple errors, the misuse of privileges, or falling victim to social engineering. We often treat employees as the “weakest link” in a mechanical sense, but the “State of Human Risk 2026” report highlights that insider threats and credential misuse are driven by complex human behaviors rather than just a lack of technical tools. An employee might be juggling three high-priority tasks and a personal emergency when a seemingly urgent request from a supervisor pops up, leading them to bypass standard protocols. It is this intersection of high-pressure work environments and targeted manipulation that makes the human element so difficult to secure with code alone.
Why are so many organizations struggling to move past basic awareness into what experts define as a truly mature security culture?
It is concerning to see that only one-third of organizations have achieved what we consider a mature awareness program. According to recent findings, 21% of companies are successfully driving long-term culture change, while a mere 12% have reached the pinnacle of optimization and resilience. This leaves a massive 67% of organizations stuck in a state of immaturity, where training is likely seen as an annual chore rather than a vital organ of the business. A mature program doesn’t just teach people what a threat looks like; it embeds security into the very DNA of how people work, so that verifying a request becomes as natural as locking the front door. Without this shift toward resilience, the other 3% of organizations that report having no program at all are just the tip of a much larger iceberg of vulnerability.
What are the specific dangers of viewing cybersecurity training merely as a compliance exercise designed to satisfy auditors?
When leadership treats training as a “check-the-box” task, they inadvertently signal to the staff that the material isn’t actually important for the business’s survival. Roughly 19% of surveyed organizations fall into this trap, designing programs primarily to meet specific audit or contractual requirements rather than to change how people act. As experts like Tom Gould have noted, just because you tell someone what to do in a video doesn’t mean they will actually execute that behavior when the stakes are high. Effective training should manifest in observable behaviors, such as an employee recognizing a suspicious situation and feeling comfortable enough to ask for help immediately. If a worker passes a quiz with a perfect score but doesn’t know how to report a mistake they’ve already made, the compliance effort has failed its most fundamental test.
With the rapid rise of artificial intelligence, how have the tactics used by malicious actors changed, and how should training programs evolve to keep pace?
The threat landscape has shifted so dramatically that the traditional “red flags” we used to teach are now largely obsolete. About 40% of professionals reported encountering AI-driven social engineering attacks in the past year alone, which means we can no longer rely on spotting poor grammar or awkward phrasing to identify a scam. AI can now generate perfectly written, highly personalized messages that mimic the specific tone and style of a company’s internal communications. If our training programs are still using examples from a decade ago, we are essentially training our troops for a war that is no longer being fought. We must teach employees to verify the intent and the channel of the communication rather than looking for superficial errors in the text itself.
Why is the traditional “one-size-fits-all” approach to employee training failing, and how can we customize education for different departments effectively?
A general training module might explain what a strong password is, but it won’t help a finance professional who is being targeted by a deepfake audio clip of the CFO requesting an urgent wire transfer. We saw this vulnerability play out in major incidents like the 2023 Caesars Entertainment attack, where a help desk vendor was manipulated into resetting multi-factor authentication for a privileged account. Training a graphic designer on help desk protocols is a waste of time, just as training a customer service rep on fraudulent invoices doesn’t lower the organization’s primary risks. At leading firms like DXC Technology, they are now using AI to send personalized phishing simulations tailored to an individual’s specific role and location. This ensures that the lessons are relevant to the actual “battlefield” the employee occupies every day, making the information much more likely to stick.
How do gaps in the scope of a training program—such as ignoring vishing or the risks of QR codes—leave the back door open for sophisticated attackers?
Many programs are far too narrow, focusing almost exclusively on email-based phishing while ignoring the myriad of other ways an attacker can gain a foothold. An employee might be hyper-vigilant about their inbox but completely blindsided by a “vishing” phone call or a malicious QR code posted in a common area. Beyond just knowing these threats exist, workers need to practice their responses under pressure so they don’t freeze when an “urgent” request appears. It’s about creating a safe environment where someone can say, “I think I messed up,” and know exactly which trusted channel to use for reporting. If the training doesn’t provide a clear, practiced path for what happens after a mistake is made, it hasn’t truly prepared the employee for the reality of a modern cyberattack.
What is your forecast for the future of cybersecurity training and the human role in defense?
I expect we will see a total departure from the “annual seminar” model in favor of continuous, AI-driven behavioral nudges that adapt to how each specific employee interacts with technology. By 2028, the most successful organizations will treat security awareness as a form of “muscle memory” rather than academic knowledge, using real-time simulations that reflect the latest agentic AI threats. We will move away from punishing people for clicking on links and instead reward them for the speed and accuracy of their reporting, turning the entire workforce into a distributed sensor network. The goal is to reach a state where the human element is no longer the greatest risk, but rather the most resilient and adaptive layer of our collective defense strategy.