Mike Polatsek and the trouble with passing the test

You can pass a driving test on paper and still be a menace at a junction. Mike Polatsek likes that gap: the distance between knowing a rule and remembering it when something unexpected happens. In his writing about cybersecurity, the driver is a useful stand-in for the office worker. Both can recite the instructions. Both eventually have to make a decision without a helpful examiner whispering in their ear.

Polatsek, co-founder and CEO of CybeReady, has built much of his working argument around that awkward interval. A completed course tells an employer that somebody completed a course. The more interesting question arrives later, disguised as an ordinary email. His concern is what a person actually does with it. The certificate, however handsomely designed, cannot reach over and stop a finger.

The teacher inside the software

His vocabulary belongs as much to the classroom as to the security operations room. Repetition. Feedback. Learning conditions. Motivation. His professional biography describes more than three decades of training work with enterprises, public companies and government agencies. That background helps explain why his preferred unit of progress is a changed response, rather than another item added to a library of lessons.

Asked in 2022 how machine learning fitted into human learning, he reached for a teacher noticing that some pupils have not understood. The teacher needs to choose another explanation, an example, perhaps a question. Software, in his account, could use repeated observations to adjust what comes next for different employees. The attraction was the possibility of responding to the learner, rather than teaching an imaginary average person.

He gave the ambition a compact formulation: “Readiness for all in a single click”. At that point, the business served organizations, but he described a wider eventual audience, including consumers and families. Automation would handle the work of getting the program delivered. People would still have to learn. The single click in his slogan was meant to simplify running the training, rather than excuse anyone from practicing.

“Readiness for all in a single click”.

Mike Polatsek, describing CybeReady’s vision in 2022

Four years before the American cheque

CybeReady emerged in Tel Aviv in the mid-2010s, founded by Polatsek and Omer Taran. Its training methodology grew from work on recognizing phishing threats to Israeli critical infrastructure. The founders added automation and machine learning, then spent four years developing the business with their own funding and European customers before its announced venture round.

By June 2019, the company had 130 customers in Europe. A $5 million round led by Baseline Ventures supported expansion into the United States. Those numbers describe a business that had spent time with customers before asking investors to finance its next step. For Polatsek’s argument about learning, the sequence is fitting: repeated encounters with a working environment came before a larger stage.

The executive chair had already changed occupants. In November 2018, Polatsek welcomed Shlomi Gian as CEO and described his own move to chief strategy officer. His new responsibilities would include customer acquisition and retention, alongside work with research and development on the product. It was a shift toward the points where customers’ experience could influence what the company built.

In 2021, he helped announce another CEO, Eitan Fogel, emphasizing Fogel’s experience building sales operations. Polatsek remained co-founder and CSO. Today he is again identified as CEO. Across those changes, his public writing supplies an unusually consistent thread: the recurring concern is how an employee learns, and how a security team can tell whether that learning has happened.

The employee is allowed to be annoyed

One of Polatsek’s more revealing early observations concerns the emotional advantages of a firewall. In 2017, he pointed out that security equipment does not have pride or object to its treatment. Employees do. A training program can interrupt somebody’s work, make a mistake feel embarrassing, then wonder why the audience has become uncooperative. The resulting resentment is part of the problem the program has created.

He objected to lessons scheduled entirely for the trainer’s convenience, generic material detached from a person’s job, and long, harsh explanations delivered after a simulated mistake. His concern was practical: a program that makes people tune out has made its next lesson harder to deliver. There is a small courtesy underneath the product argument. The employee has other work, and that work matters too.

By the time he reflected on a security training conference in Florida in 2022, he was pleased to hear more discussion of learning outcomes. He argued that employees already possess knowledge and need opportunities to use it. Practice should produce observable changes over time. An entertaining session might be enjoyable, but enjoyment alone could not settle the question he kept returning to: what happens in the inbox afterward?

Sometimes the guilty click belongs to a machine

His sympathy for the employee becomes especially concrete in a 2021 discussion of automated clicks. Security tools inspect links to check whether they are dangerous. In doing so, they can muddy the results of a phishing simulation. A dashboard may look as though more people made a mistake when some of the activity came from the organization’s own protective machinery.

Polatsek described two consequences. The numbers become harder to defend in front of management. Then employees asked to account for a supposed failure may challenge the evidence. He compared that defensiveness to the response of a driver pulled over by police: the first instinct is often to dispute the measurement. Nobody enjoys becoming an improvement project on the strength of a dubious number.

His proposed focus included following the balance between employees in lower and higher risk groups over time. The wider point was about trust. If the learning program becomes a chase after culprits, its relationship with employees suffers. Reliable measurement and useful feedback have to work together. Otherwise, the company can end up teaching its workforce to distrust the people supposedly helping it.

The coffee offer that needs a passport

Polatsek can make a global product problem sound pleasingly domestic. In a 2021 piece on international training, he described a favorite simulation involving an invented coffee chain and an offer of free coffee. An effective lure in one place might lose its appeal somewhere that favors tea or lacks familiar coffee chains. Even an imaginary café needs to understand the neighborhood.

The same piece explored the less picturesque trouble of translation: text grows, layouts break, gendered language changes who feels addressed. Working hours and local holidays can distort the results, too. A campaign sent while people are away might look reassuringly successful simply because nobody was there to click. He recommended Gabriel Szulansky’s Sticky Knowledge for readers interested in the difficulties of transferring knowledge.

These details give his argument texture. The person receiving a lesson belongs to a place, has a job, speaks a language and sometimes takes a holiday. Treating those differences as administrative clutter can spoil both the teaching and the measurements. His interest in automation runs through this problem: the machinery should absorb more of the operational complexity that makes regular, relevant practice difficult to sustain.

He had made a related point in 2018, comparing different degrees of vehicle automation. A feature described as automatic might still leave plenty for its operator to do. For a security team, he argued, the useful question was how much routine work a system actually removed, and what that freed the team to accomplish. Buying software and gaining capacity were separate achievements.

A small cheer for bureaucracy

For someone selling automation, Polatsek is willing to defend a certain amount of inconvenience. In January 2025, he wrote in praise of bureaucracy as a defense against impersonation. Written approvals, established procedures and independent verification can protect an employee faced with a persuasive request that appears to come from authority. An additional check may be tiresome. Being convincingly hurried is a reason to value it.

That argument broadens his subject beyond spotting a suspicious link. The lesson becomes the act of making a separate call, checking a request or following the approval process despite pressure. It also shows why his idea of readiness involves the organization around the employee. A person needs a usable procedure to follow, and permission to follow it when somebody apparently important wants an exception.

His 2025 writing also cautioned against relying on phishing simulations alone, discussing a broader range of training materials and tools. The test of a method remained whether it helped people respond across the situations they encountered. A simulation could supply one useful learning moment without constituting the whole education.

The coach keeps changing the drill

In June 2026, Polatsek used the World Cup to explain his position again. A coach watches improvement, adjusts practice for different positions and treats mistakes in training as opportunities to teach. He wanted security leaders to apply similar attention to their workforce. Finance staff and developers have different responsibilities; their exercises should reflect the situations they are likely to face.

His professional agenda remained visible that October. CEVRO University in Prague listed him as the presenter for an October 20 workshop on human risk management and a demonstration of CybeReady. The setting placed his long-running learning argument in another room, with another audience considering how people and systems should work together.

Across his writing, the desired outcome is modest enough to picture: somebody encounters an urgent request, pauses and makes a better decision. Getting there requires attention to timing, repetition, trustworthy evidence and the occasional cup of culturally appropriate coffee. Polatsek has spent years making the case that those details deserve a place in cybersecurity. The next ordinary email gives the argument another examination.