We accept that wearing a seatbelt reduces the risk of injury in a crash, rather than preventing the crash itself. This logic should also apply to cyber-security.
The average workforce is now more cyber-aware than ever, but awareness does not equal preparedness. When people are tired, stressed, or under pressure, they are more likely to make mistakes, such as clicking on malicious links or handing over credentials.
A comparison can be made to road safety, where campaigns highlight the risks of speeding or drink-driving, but motorists must also undergo rigorous training and testing to prepare them for driving. Relying solely on awareness would not be enough to prevent accidents.
When an incident occurs, it is the safety features of a vehicle, such as seatbelts, airbags, and crumple zones, that ultimately save lives.
Awareness alone doesn’t stop mistakes from happening.
Author's summary: Resilience is key in cyber-security.