Traditional Cybersecurity Training Is Bullshit. Here's What Protects Your Business.

By Dan J, Founder of PhishPlease

Most cybersecurity training is a waste of money that protects nobody. According to the latest Verizon research, roughly 60% of breaches come through phishing and social engineering. If you want to stop that happening to your small business, your team needs hands-on practice with realistic simulations. Not a 45-minute video they'll watch at 2x speed while eating a sandwich and mentally composing their shopping list.

I spent 3 years at Duo Security, which Cisco acquired for $2.35 billion. I've seen how the biggest, most security-conscious companies in the world approach this stuff. And I can tell you with absolute confidence: the "cybersecurity training" most small businesses buy is complete and utter bullshit. A crappy video. A multiple-choice quiz a motivated hamster could pass. A "completed" certificate that means nothing. Then everyone acts shocked when someone clicks a phishing link and the company loses $50,000 to wire fraud they never saw coming.

The problem is bigger than most people realize

The 2025 Verizon Data Breach Investigations Report found that 60% of all confirmed data breaches involved the human element. Social engineering, phishing, credential theft, someone clicking something they shouldn't have. Not nation-state hackers. Not some genius exploit slithering past your firewall while dramatic music plays. A person, tricked by an email.

Think your company is too small to bother with? Barracuda Networks found that an employee at a company with fewer than 100 people receives 350% more social engineering attacks than someone at a large enterprise. Attackers aren't ignoring small businesses. They target them on purpose, because the defenses are thin, the budgets are tight and the training is usually nonexistent. You're the house with no locks on a street where everyone else has alarms. You don't get burgled because you're special. You get burgled because you're the easiest option on the street.

Barracuda's 2025 email security report found that 78% of organizations had an email-related breach in the past year. Recovery costs per employee hit $1,946 at smaller firms, against $243 at larger ones. For a 25-person company, that's nearly $50,000 from a single incident. Add lost clients, reputational damage and three weeks of chaos while everyone scrambles like ants whose hill got kicked over.

If most breaches start with someone tricked by a phishing email, training your people to spot those emails isn't "one of many things you should do." It's THE thing. The biggest lever you can pull. The one investment that addresses the documented, statistically proven way companies like yours get wrecked.

Why the training you're buying doesn't fix this

The annual video problem. Someone in management buys a training platform and assigns a 30-to-60-minute video. Everyone clicks through it over lunch while answering Slack and wondering what to have for dinner. At the end there's a quiz: "Should you click links from unknown senders?" Everyone passes. Everyone gets a certificate. Nobody's behavior changes. The Ebbinghaus forgetting curve shows people forget roughly 70% of new information within 24 hours without reinforcement. The video your team watched last March washed away like a sandcastle at high tide.

Here's the part that makes me want to throw my laptop out of a window. A training program can have a 100% completion rate and 0% impact on behavior. If nobody paid attention, retained anything or changed a reflex, what did you pay for? A PDF proving your employees can click "next" 47 times in a row? Congratulations, you've bought the world's most expensive screensaver.

The test that tests nothing. When companies do run phishing simulations, the emails are often hilariously fake. Passing them proves as much about your team as beating a toddler at arm wrestling proves about your fitness. Emails from "Amaz0n", in grammar that suggests the author was mid-seizure, so obvious they may as well carry a flashing banner that says "THIS IS THE FAKE ONE." Your team spots them and the click rate drops to 2%. Leadership pops champagne, like someone who outran a tortoise and now reckons they're ready for the Olympics.

Meanwhile, real phishing emails in 2026 are written by AI. They're grammatically perfect. They're personalized with details scraped from LinkedIn. They reference real projects, real colleagues and real vendors. Training your team against cartoon fakes is like preparing for a cage fight by wrestling a beanbag.

The frequency problem. Even decent training, done once a year, is nearly useless. Threats change monthly. Verizon reports AI-generated phishing has doubled in volume over the past two years. Annual training is a 2019 flu shot in 2026. The threat has mutated beyond recognition, and your protection expired long ago.

What works

At Duo, security wasn't a once-a-year event. It was part of how people worked every day. That's the model. I built PhishPlease to give small businesses the same protection without the million-dollar budget.

Hands-on practice beats passive watching. You wouldn't hand someone a pamphlet about driving and then toss them the keys on the motorway. Phishing training works the same way. Send realistic simulations. Give feedback the moment someone clicks. Show a short lesson on what they missed. Do it again next month. Simulate, catch, teach, repeat.

Short and frequent beats long and annual. A 2-minute lesson right after someone clicks a simulated phishing link beats a 45-minute video they watched seven months ago. They've forgotten that video as thoroughly as a goldfish forgets a magic trick. Monthly simulations, micro-lessons, immediate feedback. That's how people learn.

Realistic simulations beat obvious fakes. If your simulations never catch anyone, they flatter your team into a false sense of security. That confidence shatters the moment a real attack arrives. We send emails that look like the real thing: Microsoft security alerts with one letter off in the domain, invoice scams that match your vendor's formatting, CEO impersonation emails that reference current projects.

We're the good bad guys. We trip your people up on purpose. Not because we're arseholes, but because it's a hell of a lot better for us to catch them than a scammer who empties your bank account and vanishes like a fart in a hurricane.

The single biggest thing you can do

60% of breaches involve the human element. For small businesses the numbers are worse, because you don't have the technical backup larger companies rely on. Your team IS your defense.

You can spend thousands on firewalls, endpoint protection and intrusion detection. All of it becomes worthless the moment someone types their password into a fake login page because an email looked convincing. Your security stack fails at the point where a person decides what to do with an email. A chain is only as strong as its weakest link, and your weakest link gets yanked 350% more often than anyone else's.

Train your people. Use realistic simulations, not crappy videos. Train them monthly, not annually. Give them respect and immediate feedback, not gotcha tests designed to humiliate. Make reporting a suspicious email the easiest, most rewarded behavior in your company.

That's the most important investment you can make in your company's security. Not one of many. THE one. The breach that hits your business won't come through your firewall. It'll come through your inbox.