Stop treating security training as a yearly compliance checkbox (Web Pulse, 2026)