Access guidance on designing and implementing employee security training programs that reduce human risk. Topics include security onboarding, ongoing awareness campaigns, compliance requirements, and measuring training effectiveness across your organization.
posts
The Program That Looked Great on Paper — Until the Breach A mid-size healthcare company I consulted with had a 98% training completion rate. Every employee had clicked through every module. Leadership was proud. Then a single phishing email — disguised as a benefits enrollment update — compromised credentials for three domain admin
One Click Cost MGM Resorts $100 Million In September 2023, a threat actor called Scattered Spider called MGM Resorts' IT help desk, impersonated an employee, and gained access to internal systems. The result? Over $100 million in losses, days of disrupted operations, and a data breach affecting millions of
The Breach That Started With a Single Click In 2023, MGM Resorts lost an estimated $100 million after a threat actor social-engineered the company's IT help desk with a ten-minute phone call. The attacker didn't exploit a zero-day vulnerability. They didn't brute-force a password.
One Click Cost MGM Resorts $100 Million In September 2023, a threat actor called Scattered Spider social-engineered an MGM Resorts employee through a simple phone call to the IT help desk. That single conversation — not a sophisticated zero-day exploit, not a nation-state attack — led to a ransomware incident that shut
A $4.88 Million Problem With a Training-Shaped Solution IBM's 2024 Cost of a Data Breach Report put the global average breach cost at $4.88 million. That number alone should end every budget debate about security awareness programs. But I still sit in meetings where executives ask
In 2023, MGM Resorts lost roughly $100 million after a threat actor social-engineered their way past the help desk with a single phone call. The attackers didn't exploit a zero-day vulnerability. They didn't write custom malware. They called an employee, pretended to be someone from IT,
The Breach That Bankrupted a 40-Person Company In 2023, a small accounting firm in Sacramento lost every client record it had. An employee clicked a link in what looked like a DocuSign notification. Within 72 hours, the ransomware encrypted everything — backups included. The firm closed its doors three months later.
Your Board Doesn't Care About Completion Rates I sat in a meeting last year where a CISO proudly reported a 97% training completion rate. The board nodded politely. Two months later, a single phishing email led to a credential theft incident that cost the organization $2.3 million
One Click Cost MGM Resorts $100 Million In September 2023, a threat actor called Scattered Spider called the MGM Resorts help desk, impersonated an employee found on LinkedIn, and convinced IT staff to reset credentials. The result: ten days of operational chaos, encrypted systems, and an estimated $100 million in
A $1.3 Million Fine for Skipping the Basics In 2023, the FTC settled with Drizly and its CEO after a data breach exposed roughly 2.5 million customer records. The root cause? The company failed to implement basic security measures — including adequate employee security training. The FTC's
