Security Teams Need to Understand How Software Actually Gets Shipped

Cybersecurity training has an awkward reputation. For many employees, it arrives as an annual module, a collection of familiar warnings and a quiz that strongly encourages remembering whatever appeared on the previous screen. Meanwhile, the workplace has become considerably less predictable. ENISA’s latest Cybersecurity Month data shows that 74% of surveyed employees had received suspicious emails, messages, voice communications or links at work during the previous six months. Phishing remained the most common example, but employees also encountered attempts to steal personal information, passwords, AI-generated scams, malware and ransomware. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] Yet only 45% said their organization regularly sends cybersecurity awareness information or updates. The interesting part is that employees don’t appear uninterested. Eighty-five percent said they wanted to improve their cybersecurity skills. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] The gap is partly about how training is delivered. THE BIGGEST TRAINING PROBLEM MAY BE THE CALENDAR Among employees who identified obstacles to developing cyber skills, 26% cited finding time during work, ahead of cost at 16%, followed by limited information about training and insufficient employer support. ENISA [https://www.enisa.europa.eu/news/cybersecurity-month-work-employees-skills-under-the-looking-glass] That matters because

For cybersecurity teams, AI is quickly moving from something experimental to something people actually use. The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 77% of surveyed organizations had adopted AI for cybersecurity. It is already being used for tasks such as phishing detection, intrusion response and user-behaviour analysis. That sounds like good news for teams struggling with workload. And mostly, it is. But AI doesn’t remove the need for skilled cybersecurity professionals. It changes what those professionals need to be good at. AUTOMATION CAN DO MORE. SO HUMANS HAVE TO DO MORE TOO. The same WEF research found that 54% of organizations considered insufficient knowledge or skills a barrier to using AI effectively in cybersecurity. Another 41% pointed to the need for human oversight. That second number matters. AI can analyse enormous amounts of information quickly. What it still struggles with is context: whether an unusual event is genuinely dangerous, how a technical issue affects the business and what action makes sense when the available information is incomplete. Cybersecurity professionals increasingly need

A suspicious connection appears in a corporate network. The security team investigates, isolates the affected system and starts remediation. In a conventional IT environment, that may be a reasonable first response. Now imagine the affected system controls part of an electricity substation, a water treatment facility or an industrial production line. Isolating it without understanding the operational consequences could disrupt a process that needs to remain stable and safe. This is one of the defining challenges of operational technology (OT) security. NIST's Guide to Operational Technology Security explains that OT systems interact with the physical environment and operate under specific performance, reliability and safety requirements. Security decisions must account for those requirements alongside confidentiality and integrity. [https://www.google.com/s2/favicons?domain=https://www.nist.gov&sz=32] NIST +1 For cybersecurity workforce development, that changes the training equation. KNOWING THE NETWORK ISN'T ENOUGH OT environments include industrial control systems, supervisory control and data acquisition (SCADA), building automation and other systems that monitor or control physical processes. Their operating requirements can differ considerably from those of ordinary business IT. [https://www.google.com/s2/favicons?domain=https://www.nist.gov&sz=32] NIST A security practitioner working in this environment needs