Click, Fail, Repeat

Security Awareness Training and phishing simulations are some of the most debated controls in modern cybersecurity programs. Some CISOs argue they don't work, claiming users will always click and that organizations should rely entirely on technology to stop attacks. Others believe the human element remains one of the most critical layers of defense.

In this episode of Deny by Default, Scott Gombar explores the controversy around Security Awareness Training (SAT) and phishing simulations. Are they just compliance checkboxes, or do they still play an essential role in protecting organizations from modern cyber threats?

Scott breaks down why attackers continue to target people through phishing, social engineering, and business email compromise—and why ignoring the human layer of security may actually increase risk.