Organisations buy security tooling and treat training as a compliance formality. But the recurring entry point is a person: a convincing message, a reused password, a helpful action taken under time pressure. No amount of perimeter spend addresses that directly.
Deliver awareness training built around how attacks actually reach people in an organisation, rather than a generic slide deck about viruses. The goal is changed behaviour in ordinary situations, not a certificate.
Detail
I'm not naming the organisation that received this training. I describe it here as an organisation in Dammam.
I describe only the subject areas I covered. I make no assessment of the organisation's security posture here, and none would be appropriate to publish.
Stack