Every layer of Invisible Configuration Debt Delvetek finds and fixes — MFA, admin roles, backups, endpoint protection — sits on top of one control that no software can fully automate: whether the person reading an email recognizes it as an attack.

AI-driven phishing now accounts for the large majority of phishing attempts businesses face, and these messages are convincing enough that a caught attempt is often described as a “near miss” rather than something staff were trained to expect.

Cyber insurers and client security questionnaires have caught up to this reality — many now ask directly whether staff receive regular, documented security awareness training, not just whether a policy exists.