Topic starter
02/08/2026 12:23 pm
TL;DR: Awareness alone does not prove resilience when passwords, MFA, phishing reporting and patching are the controls in question, according to Cymulate. Organisations need continuous exposure validation to confirm those controls still perform in real environments.
Editorial analysis by NHI Mgmt Group, based on content published by Cymulate: “Cybersecurity Awareness Month: Secure Our World”.
Key questions
Q: Why do passwords and basic MFA still fail in real breaches?
A: Because attackers do not need to defeat the system if they can reuse, relay, or socially engineer the factor.
Q: How should security teams measure whether smishing training is actually reducing risk?
A: Measure whether employees behave differently, not whether they completed a module.
Q: What should teams do when MFA still allows account compromise?
A: Teams should move high-risk accounts to phishing-resistant methods, restrict device enrollment, and review whether support workflows let attackers impersonate legitimate help-desk activity.
Practitioner guidance
- Test MFA enforcement across all login paths Validate primary sign-in, recovery, privileged access and application-specific flows so MFA is not bypassed through exceptions or legacy integrations.
- Run controlled password spray and credential stuffing simulations Check whether weak, reused or compromised credentials still succeed against internet-facing and internal authentication surfaces.
- Measure phishing reporting as a response control Track whether users can recognise, report and escalate suspicious messages quickly enough to support containment and triage.
Bottom line: Cybersecurity awareness is not enough on its own because resilience depends on whether passwords, MFA, phishing reporting and patching are actually enforced and validated in the environment.
Glossary terms: Callback Validation, Authentication Coverage Gap, Exposure Validation, Credential Abuse
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:23 pm
Validation is now the governance test for awareness programmes. Security awareness only matters when organisations can prove that the associated controls work under realistic conditions. Password policy, MFA and phishing training should be treated as control claims that need evidence, not slogans that live in a campaign calendar. The practitioner conclusion is simple: move from stated hygiene to measurable resilience.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations validate patching or focus on awareness first?
A: Validate patching first when the risk is exploitability, because awareness does not stop a reachable vulnerability from being used. Organisations should prioritise the systems that are both exposed and exploitable, then use awareness work to support the human behaviours that keep those remediation workflows effective.
👉 Read our full editorial: Cybersecurity Awareness Month puts validation at the center of resilience