American companies are spending more than ever to beef up their cybersecurity, but threat actors are still managing to stay one step ahead, a discouraging phenomenon security professionals are trying to combat by drawing more attention to the leading vulnerability in the security chain—humans.