Computer Security News and Insights
Your Computer Security Software Didn't Stop the Breach In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that bypassed every piece of computer security software the company had deployed. The threat actors didn't hack through a firewall. They called the help
In 2024, MGM Resorts lost an estimated $100 million after a threat actor social-engineered an IT help desk employee with a ten-minute phone call. The attacker didn't exploit a zero-day vulnerability. They didn't brute-force a password. They simply convinced a human being to hand over access.
3389: The Port That Keeps Giving — to Attackers In 2023, the FBI's Internet Crime Complaint Center flagged Remote Desktop Protocol (RDP) as the single most common initial access vector in ransomware incidents reported to law enforcement. Not phishing. Not USB drives. RDP. And yet, in 2026, I still
The Breach That Started With a Single Password In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered their way past a help desk using nothing more than a phone call and a LinkedIn profile. No zero-day exploit. No advanced malware. Just a
A $12.5 Billion Problem That Keeps Getting Worse The FBI's Internet Crime Complaint Center reported $12.5 billion in cybercrime losses for 2023 — a 22% jump from the prior year. And the trajectory hasn't slowed. If you're reading this in 2026 and still
There are roughly 500,000 unfilled cybersecurity positions in the United States right now, according to CyberSeek, the workforce analytics tool backed by NIST and CompTIA. That's not a future projection — that's a gap employers are desperately trying to close today. If you've been
A Marketing Team's Slack Alternative Cost Their Company $2.1 Million I once consulted for a mid-sized healthcare firm that suffered a data breach because three employees in the marketing department decided to use an unsanctioned project management tool. They uploaded patient-adjacent data to a platform with zero
The SEC Made It Official — Boards Can't Plead Ignorance Anymore In July 2023, the SEC adopted rules requiring public companies to disclose material cybersecurity incidents within four business days and to describe their board's oversight of cyber risk annually. That wasn't a suggestion. It
The Framework 80% of Organizations Reference — But Few Actually Implement When Change Healthcare suffered its catastrophic ransomware attack in early 2024, disrupting pharmacy operations for millions of Americans, the post-incident analysis pointed to gaps that the NIST Cybersecurity Framework was specifically designed to prevent. Missing multi-factor authentication on a critical
Why Threat Actors Love Targeting Law Firms In 2023, the international firm Bryan Cave Leighton Paisner disclosed a breach that exposed personal data of over 50,000 individuals — many of them clients of major corporations the firm represented. The attackers didn't need to hack every Fortune 500 company
