Resources and best practices for designing and delivering effective security awareness training programs. Covers phishing simulations, compliance requirements, behavior change techniques, measuring training effectiveness, and fostering a culture of vigilance across organizations.
posts
The Colonial Pipeline Just Proved Your Software Isn't Enough On May 7, 2021, a single compromised password shut down the largest fuel pipeline in the United States. Colonial Pipeline's systems went dark, gasoline shortages spread across the Southeast, and a ransomware gang called DarkSide walked away
The Colonial Pipeline Attack Started with a Single Compromised Credential As I write this, Colonial Pipeline is still scrambling to restore fuel delivery to the southeastern United States after a ransomware attack that shut down 5,500 miles of pipeline. The FBI confirmed DarkSide as the threat actor. While the
In July 2020, a 17-year-old in Florida convinced a Twitter employee to hand over internal credentials. Within hours, the attacker hijacked accounts belonging to Barack Obama, Elon Musk, and Apple — tweeting a Bitcoin scam to millions. The breach didn't start with a sophisticated exploit or zero-day vulnerability. It
One Phish Email Took Down a $60 Billion Company's Defenses In 2023, MGM Resorts International lost roughly $100 million after a social engineering attack that started with a single phone call to their help desk. But most attacks don't even require that much effort. The average
In 2023, MGM Resorts lost roughly $100 million after a threat actor called a help desk, impersonated an employee found on LinkedIn, and talked their way past security controls. No zero-day exploit. No nation-state malware. Just a phone call. That incident crystallized something I've been telling organizations for
One Click Cost This Company $100 Million In 2023, MGM Resorts was brought to its knees — not by a sophisticated zero-day exploit, but by a phone call and a phishing email. Threat actors from the Scattered Spider group used social engineering to gain access, eventually deploying ransomware that disrupted operations
In January 2024, CISA itself disclosed that a threat actor had exploited vulnerabilities in Ivanti products to breach two of its own systems. Let that sink in. The federal agency responsible for setting cybersecurity standards for the entire nation got hit. If that doesn't convince you that simply
In 2024, a single compromised employee smartphone gave a threat actor full access to a healthcare company's patient records — 1.4 million individuals affected, an OCR investigation opened, and a brand reputation shattered. The initial vector? A phishing link sent via SMS that bypassed every email filter the
A Single Click That Cost $100 Million In 2023, MGM Resorts was brought to its knees — not by a sophisticated zero-day exploit, but by a phishing attack that started with a phone call to an IT help desk. Threat actors from the Scattered Spider group used social engineering to impersonate
The FBI Gmail Alert That Should Have Your Full Attention In 2023, the FBI's Internet Crime Complaint Center (IC3) received over 298,000 phishing complaints — and Gmail accounts were among the most targeted. The FBI has repeatedly issued warnings about sophisticated phishing campaigns targeting Gmail users, including AI-generated
