Cybersecurity is an ongoing effort that never ends. The bad actors never stop trying and devising new methods to exploit vulnerabilities. One of the most significant vulnerabilities is humans in the enterprise. Even though we built these organizations for the benefit of humans, they continue to do things like choosing terrible, easy-to-guess passwords and finding ways to circumvent security controls. In addition to using preventive and detective controls, education is one of the best ways to reduce the risk posed by humans. Teach users why and how to behave, and most will comply. However, building a learning organization is often overlooked completely or not fully invested in and thorough.