Topic
Set of user-focused best practices—like checking links and verifying signatures—meant to help people recognize phishing and other social-engineering attacks.
Pistachio's read of 354,962 simulations at 648 organizations puts clicking and credential submission at their worst around month six, when the testing is heaviest and half of it is rated hard. Quarterly click reporting lands there.
Reality
ESET's Jake Moore says a person can inspect a link exactly as they were taught and still be fooled, because one Cyrillic character renders as the Latin one.
Reality
The company showed 1,722 people a mix of human and AI-written comments in a simulated feed. The accounts they caught most reliably were the hostile ones that awareness training already teaches staff to distrust.
Reality
Seemant Sehgal, whose firm sells continuous penetration testing, says AI agents have cut the skill needed to run a full intrusion campaign. His evidence is two August 2025 incidents and one unmeasured claim about speed.
Reality
The firm's argument is that ubiquitous TLS moved the risk off the wire and onto patch state, fake login pages and certificate warnings people click through. That is where the training hour should go.
Reality
The claim arrives as a Barracuda-authored commentary with one number behind it. The bill lands on awareness programs whose template libraries and click-rate baselines were built on deliberate typos.
Reality
Fast Company's roundup of four working email scams includes three that never show a link worth hovering over, which leaves both the awareness module and the mobile device policy answering a question users no longer face.
Reality
Malwarebytes found a 41-site network whose download buttons hold genuine Steam and VideoLAN links, then use JavaScript to send the click elsewhere. Awareness training needs a rewrite.
Reality