Resources focused on building a security-conscious workforce through training, awareness campaigns, and policy enforcement. Topics include phishing simulations, security onboarding programs, acceptable use policies, and techniques for fostering lasting behavioral change among employees.
posts
In October 2022, a Medibank employee's credentials were stolen through a single compromised login — no multi-factor authentication in place. The breach exposed the personal health data of 9.7 million Australians and became one of the most damaging incidents of the year. The attack didn't start
In 2022, a single employee at Twilio clicked a phishing link embedded in a fake IT notification. That one click gave threat actors access to internal systems and exposed data tied to over 130 organizations. The root cause wasn't a firewall failure or a zero-day exploit — it was
In March 2021, a business email compromise attack tricked an employee at a Scottish charity into wiring £173,000 to a threat actor posing as a construction firm. The employee wasn't careless. They weren't stupid. They simply hadn't been trained to spot the signs.
In 2020, a Tesla employee was offered $1 million by a Russian threat actor to plant malware on the company's network. The employee reported it to the FBI instead, and the conspirator was arrested. That's the version of the story where everything goes right. Most insider
In March 2021, a mid-size law firm in Atlanta lost $2.3 million to a single wire fraud attack. The attacker spoofed the managing partner's email, requested an urgent transfer, and a paralegal complied without hesitation. When the firm investigated, they discovered their annual security awareness program consisted
One Click Cost Colonial Pipeline $4.4 Million In May 2021, a single compromised credential shut down the largest fuel pipeline in the United States. Colonial Pipeline paid a $4.4 million ransom to a threat actor group called DarkSide. The entry point wasn't some exotic zero-day exploit.
The Receptionist Who Handed Over the Keys to the Kingdom In 2020, a Twitter employee received a phone call from someone claiming to be from the company's IT department. That single social engineering call — combined with a handful of others — led to the compromise of 130 high-profile accounts,
89% of Employees Think They'd Spot a Phish. The Data Says Otherwise. I ran a phishing simulation for a mid-size law firm last year. Before the test, we surveyed staff — 89% said they were confident they could identify a phishing email. Then we sent three simulated phishes over
Most Security Quizzes Are a Waste of Everyone's Time I recently reviewed the cybersecurity training program at a mid-size financial services firm that had been breached through a credential theft phishing email. They had a training program. They had quizzes. Every employee passed with flying colors — 95% average
The Accountant Who Cost Her Company $2.3 Million She wasn't careless. She wasn't stupid. She was a 15-year veteran of her firm's finance department, and she followed what she thought was a legitimate email from the CEO asking for an urgent wire transfer.
