Notifications
Clear all
Topic starter
02/08/2026 12:20 pm
TL;DR: Cybersecurity awareness programs still miss the gap between what people are trained to do and what controls actually enforce, with examples spanning overlooked MFA exceptions, hidden password reuse, missed patching, lateral movement, and weak detection, according to Horizons.ai. The practical shift is from education alone to continuous verification that proves whether policy survives real attack conditions.
NHIMG editorial — based on content published by Horizons.ai: From Awareness to Assurance, Turning Cybersecurity Awareness Month into a Year-Round Practice
By the numbers:
- 569 of 1,500 passwords were still vulnerable due to reuse, showing how user behavior can quietly undermine policy strength.
Questions worth separating out
Q: What breaks when security awareness is not backed by verification?
A: Training without verification creates a false sense of control.
Q: Why do identity exceptions create outsized security risk?
A: Exceptions matter because attackers do not need every control to fail, only one path that remains unverified.
Q: How can security teams measure whether human resilience is actually improving?
A: Measure behavioural outcomes, repeat susceptibility, and the reduction of risky actions in high-value cohorts.
Practitioner guidance
- Test control exceptions explicitly Run validation against the accounts, systems, and paths most likely to be overlooked, including privileged exceptions, legacy authentication routes, and manually maintained patches.
- Re-test after every remediation Make retesting a required step after fixing a weakness, especially where MFA, segmentation, or patching was bypassed in practice.
- Measure assurance, not participation Track whether controls actually blocked attack chains, then compare those results over time across human identities and NHIs.
What's in the full article
Horizons.ai's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how NodeZero validates real attack paths across identity, patching, and segmentation weaknesses
- Specific test scenarios that exposed overlooked MFA exceptions, password reuse, and unvalidated network boundaries
- Practical examples of how re-testing after remediation turns findings into measurable assurance
- Details on how tripwires and AD tripwires are used to detect bypass attempts in live environments
👉 Read Horizons.ai's analysis of awareness, verification, and control assurance →
Awareness without verification: are your controls actually working?
Explore further
02/08/2026 1:21 pm
Awareness without verification is a governance failure, not a training gap. Security awareness can improve user behaviour, but it cannot prove that authentication, segmentation, patching, or detection controls are functioning as intended. The article’s examples show that control exceptions and drift are where risk actually lives. For identity leaders, the lesson is that assurance must be based on tested enforcement, not completion rates.
A question worth separating out:
Q: Who is accountable when a supposedly protected control is still bypassed?
A: Accountability sits with the control owner and the programme that accepted the exception or failed to verify it. Frameworks such as NIST CSF and NIST SP 800-53 expect controls to be effective in practice, not just documented. If a bypass remains undetected, the governance gap is as important as the technical weakness.
👉 Read our full editorial: Awareness without verification leaves security controls unproven
