Resources focused on building a security-conscious workforce through training, awareness campaigns, and policy enforcement. Topics include phishing simulations, security onboarding programs, acceptable use policies, and techniques for fostering lasting behavioral change among employees.
posts
The Threat Already Inside Your Building In 2022, a former Twitter employee was convicted of spying on behalf of Saudi Arabia, accessing the personal data of thousands of users — including dissidents — using nothing more than his legitimate employee credentials. No malware. No phishing email. Just a trusted insider with access
In 2022, a former Amazon engineer named Paige Thompson was convicted for the Capital One breach that exposed over 100 million customer records. She wasn't an outside hacker who cracked through a firewall. She was an insider — someone with knowledge of the cloud infrastructure who exploited a misconfigured
In 2024, a finance team at a mid-size logistics company wired $25 million to a threat actor who impersonated their CFO on a deepfake video call. Every person on that call had passed their company's annual security training. Every single one. That's the gap between checking
The Policy Everyone Signs and Nobody Reads In 2023, a single employee at a major casino operator plugged a personal USB device into a workstation. That device carried malware. Within hours, threat actors had lateral movement across the network. The resulting breach cost over $100 million in damages, downtime, and
In 2024, a finance clerk at a mid-sized manufacturing firm wired $25 million to a threat actor after joining a deepfake video call where every other "participant" — including the CFO — was AI-generated. The clerk wasn't careless. She wasn't stupid. She simply hadn't
A 45-Minute Quiz Stopped a $3 Million Wire Fraud In 2023, a mid-size logistics company in Ohio avoided a devastating business email compromise attack — not because of their firewall, not because of their SOC team, but because an accounts payable clerk recognized a spoofed domain. She'd seen the
In 2022, a former employee at Cash App's parent company, Block, downloaded reports containing the personal information of 8.2 million customers — months after they'd left the company. Their access had never been revoked. That single oversight triggered SEC filings, lawsuits, and reputational damage that took
The Receptionist Who Handed Over the Keys to the Kingdom In 2023, MGM Resorts lost an estimated $100 million after a threat actor called the help desk, impersonated an employee found on LinkedIn, and convinced a staff member to reset credentials. No code was written. No zero-day exploit was deployed.
The Receptionist Who Stopped a Six-Figure Wire Fraud In 2023, a mid-size accounting firm in Ohio nearly lost $380,000 because a senior partner clicked a link in a spoofed email from a "client." The person who caught it wasn't a security analyst or an IT
One Employee Stole Data. The Other Just Clicked a Link. Both Cost Millions. In 2022, a former Amazon employee was convicted for her role in the Capital One breach that exposed over 100 million customer records. That same year, the Verizon Data Breach Investigations Report found that 82% of breaches
