Same Old Security Problems: Cyber Training Still Fails Miserably

Same Old Security Problems: Cyber Training Still Fails Miserably argues that, despite years of awareness campaigns, password hygiene and phishing remain stubborn issues for organisations worldwide. The piece notes that a Dark Reading poll during Cybersecurity Awareness Month 2025 found nearly 30% of companies still rely on eight-character passwords with a mandated mix of upper and lower case letters, numbers and special characters, while 34% use single sign-on and 21% rely on password vaults.

It also highlights research showing that phishing remains effective even after training, with studies dating back to 2008 indicating no consistent drop in click rates and sometimes a rise in overconfidence among employees. The article emphasises the shift from knowledge delivery to changing behaviour, arguing embedded training and behavioural psychology insights are needed rather than fear- or shame-based tactics.

It cites behavioural scientists and practitioners who advocate personalised, contextual training and avoiding programmes that treat security awareness as a purely technical problem. According to Dark Reading, the overarching takeaway is that new approaches are required to move the needle on real-world user behaviour.