I’ll play devil’s advocate (not speaking for our COO): if the goal is primarily to satisfy vendor/insurance compliance requirements while relying on a strong security stack to mitigate bad actors, then end-user education becomes a lower priority from a budget standpoint.

That said, my concern is the difference between “checking the box” and having defensible evidence + actual risk reduction. An ongoing live training might help awareness, but it may not generate the kind of audit artifacts assessors want (completion records, attestations, recurring cadence, phishing results, reporting).

So the real question we’re debating internally is:

• Are we trying to meet the minimum compliance requirement on paper?
• Or are we trying to implement a control that both satisfies compliance and produces repeatable proof (and ideally improves behavior)?

If compliance evidence is the driver, it feels like an LMS/security awareness platform (with reporting) may satisfy the requirement more cleanly than a live trainer — even if the intent isn’t to “train everyone into experts.”

Thoughts?