For a long time, cybersecurity awareness was treated as a reasonable endpoint. If staff had completed the training, clicked through the module, and acknowledged the policy, organisations could confidently say […]