The key reason for the effectiveness of these attacks is a lack of employee training that focuses on topics like phishing and ransomware.