Attackers now use generative AI, write flawlessly in any language and increasingly reach for SMS, phone calls or QR codes instead of email. A single annual training session simply cannot keep pace.
According to APWG, 425,808 phishing attacks were recorded in June 2026, the highest monthly count since April 2023. Smishing grew by 40% quarter over quarter in Q2, and more than 145 million QR code attacks were detected in the past year alone.
In practice, it looks inconspicuous: a text message about an undelivered parcel, an “IT technician” asking for an MFA code over the phone, or a deepfake voice of the “CEO” requesting an urgent payment. Such attacks often slip past technical defenses because they target people and their trust rather than systems.
Annual e-learning explains the rules and helps with audits, but it does not show how an employee will react under pressure a few months later. Adaptive training therefore continuously tailors simulated attacks to each employee’s role, behavior and results, working in a repeating cycle:
The goal is not to catch anyone making a mistake, but to build a reflex: pause, verify the request through another channel and report it. Training does not replace technical controls such as filters or MFA; it complements them.
What to measure and why it matters
For management, knowing how many people completed a course is not enough. What matters more is the trend in click rate, the number of repeat clickers and a growing report rate, ideally broken down by department. This data also helps demonstrate compliance with the NIS2 Directive, which requires regular training for both employees and management.
Real-world results are compelling. Medicover reports an average 90% reduction in high-risk groups within the first year, and Payoneer a more than sevenfold increase in employee resilience over two years, with repeat clickers almost disappearing.
Getting started with CybeReady
This approach is the foundation of the CybeReady platform, which SECTEC offers to its customers. Using machine learning, it schedules simulations on its own, delivers short lessons in employees’ native languages, including Slovak, and automatically prepares clear reports for management. Your IT team does not have to set up or evaluate campaigns manually. Contact us and we will be happy to arrange an introductory demo.
