Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
That "Unsubscribe" Click Just Cost Someone Their Entire Network Last year, I worked with a mid-size logistics company that lost access to every file server, customer database, and email system they had. The entry point? A single spam email disguised as a shipping notification. One employee clicked an
A Single Stolen Password Cost One Company $60 Million In 2023, MGM Resorts got hit by a social engineering attack that started with a single phone call to the help desk. The threat actors impersonated an employee, reset credentials, and within hours had enough access to deploy ransomware across the
A Single Email Cost This Company $121 Million In 2019, a Lithuanian national named Evaldas Rimasauskas pleaded guilty to stealing over $121 million from Google and Facebook. His weapon wasn't malware. It wasn't a zero-day exploit. It was phishing — forged emails impersonating a legitimate hardware vendor,
What a Phish Setlist Actually Means for Your Security Team When the band Phish takes the stage, they never play the same setlist twice. Every show is crafted for the audience. Your phishing simulation program should work the same way. A phish setlist — a curated, rotating collection of phishing attack
A 45-Minute Quiz Stopped a $3 Million Wire Fraud In 2023, a mid-size logistics company in Ohio avoided a devastating business email compromise attack — not because of their firewall, not because of their SOC team, but because an accounts payable clerk recognized a spoofed domain. She'd seen the
In January 2024, a threat actor used stolen credentials to compromise a Microsoft executive's email account — no malware, no zero-day exploit, just a password spray attack against a legacy test tenant that lacked multi-factor authentication. Microsoft disclosed the breach publicly, and it became one of the most talked-about
The Breach That Proved "Trust But Verify" Was a Lie In 2020, a threat actor compromised SolarWinds' Orion software update mechanism and silently infiltrated over 18,000 organizations — including multiple U.S. federal agencies and Fortune 500 companies. The attackers didn't blast through firewalls. They
Your Employees' Credentials Are Already for Sale In March 2024, AT&T confirmed that data from approximately 73 million current and former customers appeared on the dark web. That breach didn't happen overnight — the data had been circulating in underground markets for years before anyone noticed.
The Phishing Email That Came From PayPal's Own Servers In late 2024, security researchers at Avanan documented a campaign where threat actors sent phishing invoices through PayPal's actual invoicing system — meaning the emails passed SPF, DKIM, and DMARC checks flawlessly. The same tactic has since merged
In 2022, a former employee at Cash App's parent company, Block, downloaded reports containing the personal information of 8.2 million customers — months after they'd left the company. Their access had never been revoked. That single oversight triggered SEC filings, lawsuits, and reputational damage that took
