Reading the short article it feels like the old routine of 1. Cyber incident, 2. sparse information in all directions, 3. after fixed, all personnel returns to

Reading the short article it feels like the old routine of 1. Cyber incident, 2. sparse information in all directions, 3. after fixed, all personnel returns to old habits with higher level of insecurity against a blurry, unspecific threat and back to square one. while the few sec op folks try to train employees to better secure the systems without really improving the crucial understanding of how such incidents really work. Or do I completely misinterpret such causalities?