Poor training causes security holes