Cybersecurity training needs an overhaul, though the training itself is only one small part of how security teams can influence user behavior.