The information security community is failing to educate users in a way that helps them understand cyber threats and change their behaviour.