Provides actionable strategies and proven frameworks for strengthening your organization's security posture. Articles cover risk assessment, access controls, incident response planning, network segmentation, encryption standards, and policy development for businesses of all sizes.
posts
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered an IT help desk with a ten-minute phone call. No zero-day exploit. No nation-state tooling. Just sloppy basics. That breach — and hundreds like it every year — could have been prevented with a disciplined
The Email That Cost One Company $37 Million In 2024, a finance employee at a multinational firm joined a video call with what appeared to be the company's CFO and several colleagues. Every face on that call was a deepfake. The employee authorized $25.6 million in transfers
In January 2024, a finance employee at Arup — the engineering firm behind the Sydney Opera House — joined a video call with what appeared to be the company's CFO and several colleagues. Every face on the screen was a deepfake. By the time anyone realized what happened, the employee
One Click Cost This Company $36 Million In 2023, MGM Resorts lost an estimated $100 million after a threat actor socially engineered the company's help desk with a single phone call. The attacker impersonated an employee, convinced an IT worker to reset credentials, and from there pivoted through
The Breach That Cost Change Healthcare Everything In February 2024, a threat actor used stolen credentials to access Change Healthcare's systems — systems that lacked multi-factor authentication on a critical remote access portal. The result? A ransomware attack that disrupted pharmacy operations across the United States for weeks and
In 2023, MGM Resorts lost an estimated $100 million after a threat actor bypassed their security by social engineering the help desk into resetting an employee's credentials — credentials that lacked properly enforced multi-factor authentication at critical junctures. That single phone call cascaded into one of the most expensive
The 80% Problem Nobody Wants to Talk About The 2024 Verizon Data Breach Investigations Report found that stolen credentials were involved in roughly 31% of all breaches over the past decade — and that human-element breaches, including credential theft and phishing, accounted for nearly 68% of incidents in their latest dataset.
A few years ago, a journalist filmed himself reading credit card numbers, PINs, and passwords off the screens of commuters on a London train. No malware. No exploit kit. Just a pair of eyes and a decent camera phone. That's a shoulder surfing attack in its simplest form
A Stolen Password, a $4.88 Million Problem In 2024, IBM's Cost of a Data Breach Report pegged the global average breach cost at $4.88 million — the highest figure ever recorded. The root cause in most of those incidents wasn't a sophisticated zero-day exploit. It
In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that started with a single phone call to a help desk. The attackers didn't exploit a zero-day vulnerability. They didn't write exotic malware. They called IT support, impersonated an employee, and got
