Delivers actionable advice on recognizing and preventing phishing attacks, including email phishing, spear phishing, smishing, and vishing. Covers detection techniques, employee training approaches, email security tools, and real-world phishing examples to strengthen your defenses.
posts
In 2023, MGM Resorts had a multi-billion dollar security stack — endpoint detection, firewalls, SIEM platforms, the works. A single social engineering phone call bypassed all of it. The attackers impersonated an employee, convinced the IT help desk to reset credentials, and caused an estimated $100 million in damages. If you
One Stolen Password Cost Colonial Pipeline $4.4 Million In May 2021, a single compromised password — used on a legacy VPN account without two-factor authentication — gave a threat actor access to Colonial Pipeline's network. The ransomware attack shut down fuel delivery across the U.S. East Coast. The
One Click Cost MGM Resorts $100 Million In September 2023, a threat actor called Scattered Spider called MGM Resorts' IT help desk, impersonated an employee, and gained access to internal systems. The result? Over $100 million in losses, days of disrupted operations, and a data breach affecting millions of
A financial analyst at a Fortune 500 company typed her corporate credentials into a laptop at Chicago O'Hare. The man sitting two seats behind her wasn't reading the news on his phone — he was recording her screen. Within 48 hours, the attacker used those stolen credentials
In March 2024, a threat actor breached a major healthcare provider's network using a single compromised password — no second factor required. The organization had purchased MFA licenses two years prior but never enforced enrollment. That gap cost them months of remediation and exposed the records of over 100,
In January 2024, the SEC's official X (formerly Twitter) account was hijacked after a threat actor convinced a mobile carrier to transfer the agency's phone number to a new SIM card. The attacker used SMS verification codes to reset the password and post a fake announcement
In 2023, a single MOVEit vulnerability gave threat actors access to data from over 2,500 organizations — and financial institutions were among the hardest hit. Banks, credit unions, wealth management firms, and insurance companies collectively reported hundreds of millions of compromised records. If you work in finance, you already know
The Credential Theft Problem Nobody Takes Seriously Enough In January 2024, a massive credential dump called "Naz.API" exposed over 70 million unique email addresses and passwords harvested from stealer malware and credential-stuffing operations. Most of those credentials worked because the victims reused passwords across multiple services. I&
The Average Company Uses 130 SaaS Apps — And Secures Maybe Half When I audited a mid-size financial services firm last year, they believed they had about 40 SaaS applications in production. The real number was 187. Over half were adopted by individual departments without IT's knowledge. Three of
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — more than any other cybercrime category. That number has only climbed since. I've investigated breaches at organizations of every size, and the entry point is almost always the same: one employee who
