Cybersecurity education is evolving from simple knowledge transfer to measurable risk reduction as the human risk factor is recognized.