Why Legacy Security Awareness Training is Broken

David DellaPelle: Welcome, everyone. Thank you so much for joining us today. My name is David DellaPelle. I am the co-founder and CEO of Dune Security, joined here by Michael Waite, co-founder and CTO of Dune Security.

We are here today for a very important reason. User behavior is still accounting for roughly 90 percent of breach origination within large companies. Enterprises today spend billions on legacy security awareness training and it fails to reduce user risk. High-risk users are not held accountable. Low-risk users have their time wasted. And it even creates an adversarial relationship between security teams, CISOs, and end users within the company.

It seems like lately we see more and more headlines of high-profile breaches happening against large enterprises. Especially with the advent and widespread adoption of generative AI and LLMs, a lot of the barriers to entry that historically made sophisticated attacks difficult are gone. It is a lot easier now for attackers with very little technical knowledge or background. Hackers are able to run widespread open-source intelligence on employees. They are able to gather essential details that allow them to build trust and rapport with those individuals.

[Music]

They are still hitting employees on corporate email, but more and more we see a lot of these attacks happening off-channel through encrypted messaging apps that the enterprise has no visibility into — SMS, WhatsApp, Telegram, Signal. The entire paradigm within the last two to three years has evolved dramatically.

We saw something quite interesting just a couple of weeks ago. The Wall Street Journal reported on a study of 20,000 UC San Diego healthcare employees that found no correlation between standardized security awareness training and whether those employees failed a phishing test. Seventy-five percent of users spent under one minute on a training page or clicked through as quickly as possible, and over 50 percent closed training content immediately.

The AI capabilities to run OSINT at scale mean that hackers are looking at information about your employees exposed in data breaches. They typically know their full name, address, and social security number — enough to directly call your IT help desk and get credentials reset. They are able to do this at scale for entire organizations just by knowing your domain name. The quality and overall fidelity of these attacks has increased dramatically, and I think we are just seeing the beginning of that.

[Music]

Michael Waite: I think you encapsulated those high-fidelity attacks well. The problem with legacy security awareness training is that it treated every single employee as if they were the same. Whereas we are not limited to a poor set of risk factors — we are adding more and more over time. Think about things like dark web monitoring and exposed credentials. If you are able to apply that data to an individual and tell them specifically: you are creating this type of risk to this company for these exact reasons, and the content is specifically targeted at that person, it can actually be very effective.

Our user risk scoring model empowers teams to prioritize response where it matters most, finding high-risk employees and locking down that risk. With Dune Security, organizations are able to gain real risk reduction, productivity gains, and remove the adversarial relationship that can often form between security teams and end users.

David DellaPelle: There has been a real paradigm shift in the approach that hackers are taking to infiltrate large enterprises. The industry needs an equivalent paradigm shift in how we address that. And that is exactly what we are doing at Dune Security.

Michael Waite: We take a data-driven approach to holistically understand every individual in the organization — the role they are in, the nature of the risks associated with that role, and the systems they are working with. With all of this information, we are able to put together a clear picture of the risk that each individual brings into an organization. And just like you said, it really reduces the adversarial relationship between the security team and the end user. Low-risk users — we are not wasting their time. We can empower them to do their jobs. But those people who are essential to the organization yet introduce a lot of risk due to the actions they are taking or the nature of their role — we have mechanisms to directly protect those people. The security team and the end user work together in concert, and I think that is what is necessary to meaningfully move the needle on the cybersecurity posture of our organizations.

David DellaPelle: Today's attackers are fast, operating across every channel employees use to communicate, whether within the corporate network or outside of it. Generic security awareness training is static and disconnected from real tactics. What is really needed is true risk reduction. We are building Dune Security to be the foundational company in user risk.

[Music]

We are able to reduce risk, save time — and time is money for both admins and end users — and we can even improve the security culture within a company and remove the adversarial relationship that can form. So thank you so much for your time today.