Learn how phishing simulations help organizations measure employee susceptibility to email-based attacks. Articles cover simulation design, realistic phishing templates, campaign scheduling, result analysis, and strategies for turning simulation data into stronger security behaviors.
posts
In 2024, a finance team at a mid-size logistics company wired $25 million to a threat actor who impersonated their CFO on a deepfake video call. Every person on that call had passed their company's annual security training. Every single one. That's the gap between checking
The Email That Cost One Company $37 Million In 2024, a single phishing email led to a business email compromise attack against Orion SA, a Luxembourg-based metals trading company, resulting in a $60 million wire transfer to threat actor-controlled accounts. The company later recovered roughly $23 million. The email looked
In 2023, the FBI's Internet Crime Complaint Center (IC3) received over 298,000 complaints related to phishing and its variants — including vishing — resulting in losses exceeding $18.7 billion across all reported cybercrime categories. Voice phishing, or vishing, is one of the fastest-growing attack vectors because it bypasses
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. I've investigated dozens of breaches that started with a single deceptive email. So when someone asks me what is a
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 complaints about phishing scams — making it the most reported cybercrime category for the fifth consecutive year. The real number is almost certainly higher, because most incidents never get reported. I've spent years helping organizations
The FBI Told You About Medusa. Are You Listening? In March 2025, the FBI and CISA issued a joint advisory — AA25-071A — warning that the Medusa ransomware gang had compromised over 300 organizations across critical infrastructure sectors. Healthcare systems, school districts, legal firms, manufacturers. The common thread? Almost every intrusion started
The Breach That Started With a Single Click In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered the company's IT help desk. The attacker didn't exploit a zero-day vulnerability. They didn't brute-force a password. They made
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime for the fifth consecutive year. Despite billions spent on security technology, a single deceptive email still remains the most reliable way for a threat actor to breach an
Your Employees Are Eating Phish Food Every Day In March 2024, MGM Resorts was still tallying the damage from a social engineering attack that started with a single phone call. The estimated cost exceeded $100 million. The threat actor didn't exploit a zero-day vulnerability or deploy some exotic
A Fake Invoice Cost One Company $121 Million In 2019, a Lithuanian national named Evaldas Rimasauskas pleaded guilty to orchestrating a phishing scheme that stole over $121 million from Google and Facebook. His weapon wasn't malware. It wasn't a zero-day exploit. It was email — and an
