Osterman Research surveyed 500 cybersecurity leaders and practitioners in the United States and the United Kingdom for this report, with a focus on how organizations perceive and measure readiness. The survey data we collected and analyzed for Immersive was combined with proprietary performance and benchmarking data from Immersive’s platform and a crisis simulation they ran.

Key findings:

• The cybersecurity industry has become expert at measuring readiness by activity not by outcome.
• Nearly every organization believes it is prepared for the next major incident – but underlying performance data doesn’t support such a conclusion.
• Leaders are relying on false metrics – ones that prove nothing about performance under pressure.
• The are four missteps holding readiness back, including practicing the past, fixating on fundamentals, and excluding the business.
• Organizations are failing for a lack of practiced coordination – not a lack of knowledge.

If cyber readiness and resilience in the face of growing cyber attacks is important to your organization, please get a copy from the Immersive web site, grab a cup of coffee or tea, and read to learn / adjust / improve.

Next action: get your copy of the report – 2025 Cyber Workforce Benchmark Report.

• How AI is fuelling frighteningly effective scams
  Reviews areas of malicious use of AI technology for voice and video scams, along with a brief mention of phishing. Looks at how standard AI tools can be “weaponized by criminals to create realistic yet bogus voices, websites, videos and other content to perpetrate fraud,” and why voice cloning is a particular problem for the financial services industry that has built transaction authorization around voice signatures for years.
  AARP
• Time to click for phishing links
  KnowBe4 runs the numbers on when people click on links in phishing emails. Two findings stood out: first, links in phishing messages received Monday to Friday are routinely clicked by 20% or more of users, and second, more than half of users click to open phishing emails within 60 minutes of receiving the message. KnowBe4 Blog
• The impact of generative AI on the efficacy of security awareness training
  Explores the impact of generative AI on the performance of security awareness training, emphasizing the changing dynamics as cybercriminals leverage generative AI services to remove traditional signals of compromise (e.g., spelling mistakes, poor language use) and weaponize the services to deliver individually-targeted phishing messages based on a social media profile. SCMagazine

The report takes a deep dive into the outcomes that learner’s experienced after engaging with two of its business units: ed2go (online certificate training courses in career-focused disciplines) and Infosec (cybersecurity education). There’s a set of tangible benefits noted on page 9, reporting on overall / combined outcomes, such as course completion (83%), earning an industry certification (90%), a meaningful change in employment for the learner (36%), and income growth after three years (32% average).

And then there’s a specific focus on health courses via ed2go and cybersecurity courses via Infosec. The latter was of interest to us, because yes, there continues to be a shortage of qualified people to fill open cybersecurity roles in the United States (and beyond). Infosec quantifies its contribution as upskilling over 20,000 cyber professionals over the past two years (page 17). Across these learners, those who opted into the research noted an incremental 12% increase in income during the three years after completing their course. Here’s the money diagram from the report (page 19), with the dark colored bars showing standardized income growth year-on-year due to normal factors such as more experience, time in the job, seniority, etc., and the dark yellow appendages on each bar the additional / incremental / beyond the standard extra income derived that’s attributed to taking and completing the Infosec course. That’s a pretty cool result.

The methodology is explained in the final pages of the report, including how Cengage used third party data sources to confirm change in income.