Most cybersecurity training doesn’t work. Can we change that?
In an era where AI accelerates the speed, scale, and polish of cyberattacks like phishing and deepfakes, the human element remains the most critical variable. This discussion explores why traditional 'checkbox' training fails and how immersive, stress-inducing simulations like the cyber range are essential for building the muscle memory, confidence, and decision-making skills needed for effective incident response.
Artificial Intelligence has fundamentally altered the cyberthreat landscape by enhancing the speed, scale, and polish of attacks. Threat actors can now generate sophisticated, well-crafted phishing emails and other social engineering attacks in minutes, a task that previously might have taken days of research. This allows them to launch broader, more effective campaigns. The primary application of AI in attacks is currently seen in social engineering, including phishing, deepfakes, and the rapid propagation of disinformation, which can then lead to widespread misinformation.
The Human Element: The Weakest Link and Strongest Defense
Despite the rise of AI in both attacks and defense, humans remain the central figures in cybersecurity. Attackers continue to target people as the primary vulnerability to gain initial access. Conversely, people are also the most crucial line of defense.
Defensive AI can be likened to a “fire alarm”—it is excellent at detecting anomalies and alerting defenders quickly, but it still requires a human to review the alert, investigate, and decide on the appropriate course of action. This “human in the loop” is essential for discerning real threats from false positives and for maintaining foundational cyber hygiene, which AI cannot automate.
Humans possess a unique, organic ability to sense when something “feels off,” a “gut reaction” that is difficult to replicate in AI systems. However, human inconsistency—having good days and bad days—also makes them the weakest link in a system that demands consistency. An interesting side effect of attackers using AI is the potential dissolution of their “fingerprints” or TTPs (Tactics, Techniques, and Procedures), making attribution, which is already difficult, even more challenging as attack methods blend together.
Rethinking Cybersecurity Training
Traditional cybersecurity training often gets a bad reputation because it is designed for compliance rather than capability. It becomes a “checkbox” exercise with slideshows and cheesy videos that fail to prepare employees for the reality of an attack. This type of training often gives generic advice like “don’t click on bad links,” which is insufficient against creative, modern attack vectors.
Effective training must be adaptive and cater to how different people consume information. The core goal is to build muscle memory through repetition, so that in a real crisis, individuals can respond effectively without being overwhelmed. As one panelist noted, quoting a coach: “Amateurs will train until they get it right. Professionals train until they cannot get it wrong.” This requires training under stress and as a team, accounting for the cognitive and emotional load of a real incident.
Immersive Simulation: The Cyber Range Advantage
The cyber range is a prime example of effective, modern training. It is an immersive, hands-on environment of “controlled chaos” where executive and technical teams are stress-tested against simulated cyber crises tailored to their organization’s specific fears and concerns.
Unlike a tabletop exercise, which involves more role-playing, a cyber range simulates the pressure of a real attack. A participant’s screen might suddenly lock up with a threat actor’s image while their phone rings with urgent questions. This immersive experience evokes a genuine emotional response, forcing participants to make difficult decisions under pressure when there is no clear “right” answer, only a “best of bad choices.”
Key benefits of this approach include:
- Building Confidence Under Stress: It helps de-escalate energy levels during a real event because the team has experienced similar pressure before.
- Practicing the Art and Science: Teams can practice their formal playbooks (the science) while also learning to adapt when the situation deviates from the plan (the art).
- Testing Team Dynamics: The simulation can dynamically change, for example, by removing a key team member to force the team to adapt, build redundancy, and avoid relying on a single “hero.” This exposes single points of failure and strengthens the chain of command.
From Compliance to Critical Control
Organizations must shift their perspective on training from a compliance requirement to a strategic lever for business continuity and resilience. Just as fire drills are run to prevent confusion and save lives, security training should be about preparedness, not just awareness.
Experiencing a realistic simulation in a cyber range makes the threat tangible. When employees return to their daily work, they are more likely to take security awareness communications seriously because they have felt the potential impact of a breach. This type of training builds stronger teams, closes assumption gaps between leadership and technical staff, and ultimately ensures the entire business can continue to thrive. The core message is that while AI has changed the speed of attacks, effective training determines the outcome.