Topic
Set of user-focused best practices—like checking links and verifying signatures—meant to help people recognize phishing and other social-engineering attacks.
Yubico and Okta's survey of 1,890 tech and security professionals found 23% work where multifactor login is not required on every application. With 88% still rating their company secure, at least one respondent in nine gave both answers.
Reality
Hoxhunt says its expanded Respond platform cuts phishing tickets needing analyst attention by up to 99%. Every figure in the release comes from the vendor, so a SOC weighing automated removal across inboxes has to test the classifier before switching it on.
Reality
SecurityWeek says awareness training has failed against help desk vishing, citing attacks that cost MGM an estimated $100 million. The fix it profiles is Netarx's live-call scanner for cloned voices and spoofed devices, but in both breaches it cites, callers talked help desk staff into granting access.
Reality
Pistachio's read of 354,962 simulations at 648 organizations puts clicking and credential submission at their worst around month six, when the testing is heaviest and half of it is rated hard. Quarterly click reporting lands there.
Reality
ESET's Jake Moore says a person can inspect a link exactly as they were taught and still be fooled, because one Cyrillic character renders as the Latin one.
Reality
The company showed 1,722 people a mix of human and AI-written comments in a simulated feed. The accounts they caught most reliably were the hostile ones that awareness training already teaches staff to distrust.
Reality
Seemant Sehgal, whose firm sells continuous penetration testing, says AI agents have cut the skill needed to run a full intrusion campaign. His evidence is two August 2025 incidents and one unmeasured claim about speed.
Reality
The firm's argument is that ubiquitous TLS moved the risk off the wire and onto patch state, fake login pages and certificate warnings people click through. That is where the training hour should go.
Reality
The claim arrives as a Barracuda-authored commentary with one number behind it. The bill lands on awareness programs whose template libraries and click-rate baselines were built on deliberate typos.
Reality
Fast Company's roundup of four working email scams includes three that never show a link worth hovering over, which leaves both the awareness module and the mobile device policy answering a question users no longer face.
Reality
Malwarebytes found a 41-site network whose download buttons hold genuine Steam and VideoLAN links, then use JavaScript to send the click elsewhere. Awareness training needs a rewrite.
Reality