Is security training futile?