Why training?
Many attacks start with a phishing email, a stolen password or a convincing phone call. However strong your technical controls are, a door stays open if people do not know the right behavior.
Regular, measurable training turns employees into an early warning network that spots and reports suspicious activity.