Cyber security training once a year isn’t working