Traditional security awareness training is any program intended to help people understand security risks, prevent cyberattacks, and identify breaches. However, these programs are often tick-box exercises that don’t influence long term security behaviors—and, therefore, don’t reduce human cyber risk.