What cybersecurity threat do people still not take seriously enough?

Phishing. It is still phishing. Granted, phishing is getting more sophisticated... It used to be the case that you could tell a phish because it just looked bad. Incorrect grammar, misspellings, spaces or tabs in nonsensical places, or even references to people or places that don't exist or have no relevance to the user. Now, prompts are leveraging AI to sound more realistic. New campaigns can be made fairly quickly to take advantage of current events. Spelling and grammar errors have gone way down. Deep reconnaissance will find your supervisor, your coworker, your next door neighbor. All these things make the message sound more legitimate, and causes the user to click. Or, perhaps even more insidiously, causes the user to call a number, send a text message, or email from a side channel; all things to evade established security policies. How do you block an email from a Gmail address with only a phone number and the promise of a job making $450 a week? Do we go to a default deny model for every email address? Surely we cannot just block all of Gmail, Yahoo, Hotmail, MSN and the others, right? Until we have much better filtering in place, this will always be a problem. And the problem is not new, nor is it exclusive to email. So do we use AI instead? Do we teach it to recognize bad messages rather than teaching our users? Is security awareness training and account diligence something we give to our robot overlords as well?