Every year, we talk more about the importance of cybersecurity training and awareness, but companies, regardless of their maturity in this area, keep wondering what the best strategy actually is.

Employees are the last line of defense, and given that 95% of cybersecurity incidents are due to human error, it’s genuinely surprising that training and awareness have traditionally been the “ugly duckling” of a company’s cybersecurity investment, at levels wildly disproportionate to what’s invested in protecting the technology employees actually use.

There could be excuses: treating it as a gray area between Cybersecurity and Talent, People or HR. Thinking that addressing employee behavior is a delicate subject. In short, plenty of excuses for CISOs to have treated it as a low priority.

But there can be no more excuses. Training and awareness, combined with different types of exercises, from annual cyber exercises for the leadership team to an ongoing program of simulated malicious emails, needs to be a priority in the annual cybersecurity plan.

It’s no longer enough to check the box with a policy email and an annual refresher course. Companies need every kind of resource to:

Make it more engaging, demystifying the message, adding gamification techniques, making it feel more natural for employees. Make it mandatory, tying it to employees’ annual goals and their business unit’s goals. And most importantly, manage it: measure it to improve it and evolve it year after year.

None of this requires runaway investment, just attention and a place at the top of the priority list, and, most importantly, it’s valid and necessary whether a company has 20 employees or 20,000.