We gave GISEC GLOBAL 2026 a first look at The Arena, a human resilience platform built for the decisions AI still leaves to people.

 

A floor built for machines

Walk the floor at GISEC GLOBAL 2026, and you’d think the future of cybersecurity has no people in it. If we learned one thing across the week, it was that the conversation is now dominated by AI agents, cloud technologies, and increasingly complex cyber environments. More than 750 brands from over 180 countries came to Dubai, many with AI agents that detect, decide, and respond on their own.

Meanwhile, attackers are using the same technology to write flawless phishing emails and clone your CFO’s voice. The machines are getting smarter on both sides, which makes the person in the middle more important than ever. They still have to decide whether to trust that call.

That’s why we showed up with the other half of the equation.

 

Fewer decisions, higher stakes

It’s easy to assume that as AI takes on more of the work, the human side of security shrinks. In reality, the opposite happens. When automated systems handle the routine threats, what reaches people are the tricky ones: the payment request that looks almost right, the urgent message from a colleague who isn’t quite who they seem, the video call that feels slightly off. Those moments are rarer, but the stakes are far higher.

“As technology and cyber environments get more complex, we can’t keep training people the way we did ten years ago,” said Ori Attar, Cywareness CEO. “The way people understand, experience, and respond to cyber challenges has to evolve just as fast as the tools around them.”

 

Meet The Arena

After teasing it ahead of the event, we gave attendees a first look at The Cywareness Arena and its gamified cyber awareness challenges.

The Arena turns standard awareness training into immersive, decision-driven risk training. Instead of passive slide decks and tick-box compliance, employees step into realistic, high-pressure scenarios and practise making secure decisions before a real attacker puts them to the test.

Knowing what social engineering looks like on paper isn’t the same as coming face to face with it when you’re stressed and already under pressure. In The Arena, people go head to head with a simulated threat actor, decide how to respond and see the consequences play out straight away.

Good judgement comes from practice, and The Arena gives people a safe place to make the wrong call, learn from it and get it right when it counts.

Taking the First Step Toward Security

Every organization already has the best training material: the incident log. The near-misses, the email that almost fooled someone in March, and the one that did in July. These aren’t just past events; they’re your training plan.

General lessons show what threats look like in theory. Lessons based on your own incidents show what threats look like in real life, in your inbox, from someone who nearly succeeded. Real examples stick with people. Theoretical ones are quickly forgotten.

To make training more effective, add a hands-on part that supports what people learned. Teach the theory, then a week later, send out a realistic scenario. Afterward, talk about what gave it away, what could be done differently, and thank the person who spotted it. This kind of practice helps people build real skills that generic lessons can’t provide.

 

A Step Worth Repeating

When training is based on real events, people start noticing things they would have missed before, and they talk about it. Instead of just finishing a training module, the story becomes about a coworker who caught a real threat.

That’s the moment to aim for; the one when someone says, I remember the first time we caught one of those. At that point, no one needs convincing. Everyone wants to experience that success themselves.

A first step should lead to a second and a third, until the story is no longer about October, but about the habit that started in October.

Keep moving forward, and by next October, you’ll be able to look back and see how far you’ve come.

This article was written by Cywareness, a company specializing in cybersecurity awareness.

As part of its mission, Cywareness continues to monitor emerging trends, analyze real-world attacks, and share practical insights to help organizations stay ahead in today’s evolving threat landscape.