Provides resources for building phishing awareness among individuals and teams. Articles cover how to recognize phishing emails, conduct simulated phishing exercises, develop security-conscious habits, and implement ongoing awareness training programs within organizations.
posts
In 2023, a finance employee at a multinational firm in Hong Kong wired $25 million after receiving what appeared to be a legitimate video call from the company's CFO — a deepfake. But the attack started with something far simpler: a fake email. That initial message looked routine, requested
A Fortune 500 company ran the same annual compliance training for three straight years. Completion rates hovered around 92%. Their phishing click rate? Stubbornly stuck at 31%. Then they switched to a gamified approach — leaderboards, scenario-based challenges, real-time feedback. Within six months, that click rate dropped to 11%. Cybersecurity gamification
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. Despite billions spent on email filters and endpoint detection, phishing still works. And it works devastatingly well. If you've ever
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime for the fifth consecutive year. Yet when I ask business owners what phishing actually means, most give me a vague answer about "fake emails." That incomplete
A Single Phish Email Cost One Company $100 Million In 2024, MGM Resorts confirmed that a social engineering attack — which started with a single phone call and a phish-style credential theft scheme — contributed to losses exceeding $100 million. The threat actors behind the Scattered Spider group didn't need
A 60% Click Rate That Should Have Been a Wake-Up Call I ran a phishing simulation training exercise for a mid-size logistics company last year. The first campaign used a fake Microsoft 365 password reset email — nothing fancy, no zero-day exploit, just a convincing lure. Sixty percent of employees clicked.
In May 2025, the FBI's Internet Crime Complaint Center reported that phishing was — for the ninth consecutive year — the most-reported cybercrime in the United States. Not ransomware. Not cryptojacking. Phishing. The simplest attack in the playbook continues to cause the most damage, and the phishing meaning most people
In January 2024, a finance employee at a multinational firm in Hong Kong transferred $25.6 million to criminals after a video call with what appeared to be the company's CFO. Every person on that call was a deepfake. That's where phishing lives now — far beyond
The Breach That Started With a Single Reused Password In January 2024, Microsoft disclosed that a Russian state-sponsored threat actor — Midnight Blizzard — breached executive email accounts using a password spray attack against a legacy test account that lacked multi-factor authentication. Microsoft. One of the largest technology companies on Earth. Compromised
In 2023, a finance employee at a midsize manufacturing firm in the Midwest wired $1.2 million to a threat actor who impersonated the company's CEO over email. The employee wasn't careless. She wasn't stupid. She simply hadn't been trained to recognize
