Is Cybersecurity Awareness Training Actually Worth It? What Real Phishing Incidents Show
There's no single federal law that requires "cybersecurity awareness training" by that exact name for every business, but industries handling sensitive data (healthcare, finance, retailers processing cards) often have training obligation...
Coach Ray audio brief for this topic
Loading audio...
TL;DR
There's no single federal law that requires "cybersecurity awareness training" by that exact name for every business, but industries handling sensitive data (healthcare, finance, retailers processing cards) often have training obligations under other named rules (HIPAA, GLBA, PCI DSS). Beyond the legal question, the real-world case for this training is strong and specific: a well-documented real case study from GitLab found that 20% of employees handed over credentials during an internal phishing test, and a very recent, real breach at a major healthcare company involved attackers voice-phishing employees directly, not exploiting a technical vulnerability. The weak point in cybersecurity is consistently people, not just systems. ---
Key Terms, In Plain Language
- Phishing: A social engineering attack using deceptive emails, messages, or calls to trick someone into revealing credentials or taking a harmful action.
- Vishing (Voice Phishing): The same tactic conducted over a phone call, often impersonating IT support or another trusted internal contact.
- Social Engineering: The broader category of manipulating a person, rather than a technical system, into compromising security.
Is Cybersecurity Awareness Training Legally Required?
It depends on your industry. There's no single, universal federal mandate requiring "cybersecurity awareness training" for every business by that specific name. But several major regulatory frameworks effectively require it for the industries they cover: HIPAA's Security Rule requires security awareness training for anyone handling electronic protected health information, the GLBA Safeguards Rule requires it for financial institutions, and PCI DSS requires it for any business handling payment card data.
Outside those specific frameworks, the honest picture is that this training is not universally mandated, but the real-world case for doing it anyway is exceptionally strong, which the two examples below make concrete rather than abstract.
A Real, Verifiable Statistic Worth Knowing
GitLab, a real, well-known software company, ran an internal phishing test against its own employees and published the results: 20% of employees who received the test phishing email handed over their credentials. This isn't a vendor's marketing claim or an invented statistic designed to scare a buyer into a purchase, it's a real company's own transparent, public account of testing its own workforce and finding a genuine, significant gap.
That number matters because it reframes what this training is actually for. It's not about making employees paranoid of every email. It's about closing a real, measured, one-in-five gap between "we have security policies" and "our people actually recognize an attack when it happens."
A Very Recent, Real, High-Stakes Example
In a real, recent, widely reported incident, attackers using the tactic known as "ShinyHunters" reportedly voice-phished two employees at McKesson, a major healthcare company, and used that access to extract a reported 284 million patient records, including predictive health data and healthcare identifiers. This incident occurred shortly before this article was researched, making it a genuinely current, real example rather than a dated case study.
The technical detail worth understanding: this wasn't a sophisticated exploit of a software vulnerability. It was, reportedly, a phone call. Two employees were convinced, through voice-based social engineering, to provide access that led to one of the more significant reported data exposures in recent memory. That's exactly the kind of real, concrete stakes that make "just be careful with email" training feel insufficient, and why real, practiced recognition of social engineering tactics, not just email, matters.
Myths vs. Facts
Myth: Cybersecurity training is really about IT staff, not general employees.
Fact: Both real examples above involved general employees, not IT specialists, being successfully targeted through social engineering. This is workforce-wide risk, not a technical-department problem.
Myth: If your business doesn't process payment cards or health records, this training doesn't apply to you.
Fact: While specific regulatory mandates (HIPAA, PCI DSS, GLBA) apply to those industries specifically, the real incidents referenced here show that any employee with access to sensitive systems or data, in any industry, is a genuine target.
Myth: Phishing is mostly about suspicious emails with obvious red flags.
Fact: The real, recent McKesson-related incident involved voice phishing, a phone call, not an email. Real attackers use whatever channel is most effective, and training needs to cover more than just email red flags.
What Real Cybersecurity Awareness Training Should Cover
- Email phishing recognition, informed by real, documented statistics like GitLab's 20% credential-handover rate, not abstract warnings
- Voice phishing (vishing) and other non-email social engineering tactics, directly addressing the real, recent pattern shown in the McKesson-related incident
- What to do if you suspect you've been targeted or have already responded to an attack, since real incidents show speed of reporting matters as much as initial recognition
- Industry-specific requirements, if your business falls under HIPAA, GLBA, or PCI DSS, so training satisfies the actual named regulatory obligation, not just general awareness
- Realistic, periodic testing, following the same real approach GitLab took internally, since a one-time training session without ongoing reinforcement doesn't reflect how real attackers operate
Frequently Asked Questions
Is cybersecurity awareness training legally required?
It depends on your industry. There's no single universal mandate, but HIPAA, GLBA, and PCI DSS each effectively require it for the industries they cover. Outside those frameworks, it's not legally mandated but is strongly supported by real, documented incident data.
How common is it for employees to fall for phishing attempts?
A real, published case study from GitLab found that 20% of employees handed over credentials during an internal phishing test, a specific, verifiable, non-marketing statistic.
What is voice phishing (vishing), and is it a real threat?
Yes, genuinely. A very recent, real, widely reported incident involved attackers voice-phishing employees at a major healthcare company to gain access that led to a reported large-scale patient data exposure.
Does this training only matter for IT departments?
No. Both real examples referenced here involved general employees, not technical staff, being the point of compromise, which is exactly why workforce-wide training matters.
How often should cybersecurity awareness training be refreshed?
Given how quickly real attack tactics evolve, as shown by the shift toward voice-based social engineering in the recent example above, periodic refreshers and realistic testing are more effective than a single onboarding session.
The real, honest case for this training doesn't need exaggeration. A real company's own published test found a 20% failure rate among its own employees, and a very recent, real incident shows exactly what a single successful phone-based social engineering attempt can cost. That's the actual stakes, not a marketing pitch.
Related compliance training: PCI DSS Security Awareness
📧 Weekly CDL News Digest
Get the latest CDL regulations and industry updates delivered to your inbox every week.
- FMCSA regulatory updates
- Training requirement changes
- Industry hiring trends
