In The Age Of AI, Does Your Cyber Awareness Training Know What Attackers Are Preparing?

Founder and CEO at CYFIRMA, overseeing the business strategy, product roadmap, growth & expansion plan, and investor relationship.

October is Cybersecurity Awareness Month, and most organizations will mark it the way they did last year: new posters, a refreshed e-learning module and another reminder not to click suspicious links. The intent is sound. The content is not. Most awareness programs teach yesterday’s attack methods to a generic employee, while adversaries prepare tomorrow’s attacks against specific people.

When I led cyber intelligence at a national intelligence agency, training was continuous and built on what we knew about our own weaknesses. Every briefing started with three questions: Which of our assets were exposed? Which of our routines could be exploited? Which weak spots was the adversary already probing? We trained on real exposure, not hypothetical scenarios.

Few enterprises work this way. An adversary targeting a company does not study “phishing” in the abstract. It studies that company’s weak spots: the unpatched VPN, the help desk that resets passwords by phone, the supplier with privileged access, the finance team that approves payments by email and the executives whose voices are public on earnings calls. Most awareness training addresses none of this. The CFO, the help-desk analyst and the contractor with domain admin rights all complete the same generic module.

Generic Cyber Training Is Not Working

The evidence is consistent. The 2026 Verizon Data Breach Investigations Report (DBIR) found a human element in 62% of breaches, and the FBI recorded nearly $21 billion in cybercrime losses in 2025.

Attackers personalize. Most defenders still generalize.

Show People What The Attacker Already Sees

Each of these findings becomes a pretext aimed at a specific person, yet none of it appears in that person’s training. Threat-led training closes the gap by putting what the attacker already sees in front of the people who will be targeted.