Learn how phishing simulations help organizations measure employee susceptibility to email-based attacks. Articles cover simulation design, realistic phishing templates, campaign scheduling, result analysis, and strategies for turning simulation data into stronger security behaviors.
posts
A $1.3 Million Fine for Skipping the Basics In 2023, the U.S. Department of Health and Human Services fined Lafourche Medical Group $480,000 for a phishing attack that compromised nearly 35,000 patient records. The root cause wasn't a sophisticated zero-day exploit. It was the
In 2024, the average cost of a data breach in the financial sector hit $6.08 million — the second-highest of any industry, trailing only healthcare. That number comes straight from IBM's Cost of a Data Breach Report. I've spent years working with banks, credit unions, and
Your Board Doesn't Care About Completion Rates I sat in a boardroom last year where a CISO proudly presented a 97% training completion rate. The CFO's response: "So why did we just pay $2.3 million to recover from a ransomware attack?" That question
Your Training Program Might Be Failing — and You'd Never Know In 2024, IBM's Cost of a Data Breach Report pegged the global average breach cost at $4.88 million. Organizations with security awareness training and incident response planning cut that number dramatically. But here's
A 45-Minute Training Video Nobody Watched In 2023, a mid-size healthcare company I consulted for spent $60,000 on a compliance-focused security awareness program. It featured a 45-minute narrated slideshow, a 10-question quiz, and a certificate of completion. Their post-training phishing simulation results? A 31% click rate — virtually unchanged from
A Single Click Cost One Company $100 Million In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack — a threat actor called the help desk, impersonated an employee, and gained access to internal systems. The entire breach hinged on human behavior, not a firewall failure. That
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered the company's IT help desk with a ten-minute phone call. The attacker didn't exploit a zero-day vulnerability. They didn't brute-force a password. They just talked their way
Most Quiz Questions Are a Waste of Everyone's Time I recently reviewed a Fortune 500 company's annual security awareness program. Their quiz had 20 multiple-choice questions. One of them asked employees to define the word "malware." Another asked which year the first computer virus
In March 2025, CISA and the FBI issued a joint advisory warning that the Medusa ransomware gang had compromised over 300 organizations across critical infrastructure sectors — healthcare, education, legal, insurance, and manufacturing. The attack vector wasn't some exotic zero-day exploit. It was phishing. Specifically, carefully crafted Medusa ransomware
A Single Phish Email Cost One Company $37 Million In 2024, Orion SA disclosed that a single employee fell for a business email compromise scheme and wired approximately $60 million to a threat actor's accounts. The company recovered some funds, but the net loss still exceeded $37 million.
