Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
In January 2024, Microsoft disclosed that a Russian state-sponsored threat actor — Midnight Blizzard — breached corporate email accounts by exploiting a legacy test tenant that lacked multi-factor authentication. No zero-day exploit. No sophisticated malware. Just a password spray against a forgotten cloud account. That single oversight gave attackers months of access
The Breach That Changed How I Think About Cybersecurity In February 2024, Change Healthcare suffered a ransomware attack that disrupted pharmacy operations and medical claims processing across the entire United States. UnitedHealth Group later confirmed that roughly one-third of all Americans may have had their data exposed. The attack vector?
In January 2024, a massive credential stuffing attack compromised over 34,000 PayPal accounts — not because PayPal's systems failed, but because users reused passwords across multiple sites. The attackers didn't hack anything. They simply tried stolen credentials from other breaches and walked right in. If you&
In 2023, the FBI's Internet Crime Complaint Center received over 880,000 complaints with losses exceeding $12.5 billion — a 22% increase from the prior year. A significant portion of those complaints involved malware, ransomware, and credential theft that started with a single computer virus. If you think
In 2024, the Verizon Data Breach Investigations Report found that stolen credentials were involved in roughly 31% of all breaches over the prior decade. That number hasn't budged much. I've worked incident response cases where a single reused password — a seven-character string an employee used on
In 2024, a finance team at a mid-size logistics company wired $25 million to a threat actor who impersonated their CFO on a deepfake video call. Every person on that call had passed their company's annual security training. Every single one. That's the gap between checking
That Gmail Account Access Warning Might Be Real — Or a Trap Last month, a mid-sized accounting firm in Texas lost access to every client file they had. It started with a single employee who received what looked like a legitimate Gmail account access warning — a notification claiming someone in another
The FTC Just Fined a Company $1.5 Million — Because They Skipped the Basics In 2023, the FTC settled with Chegg for $3.5 million after four separate data breaches exposed tens of millions of customer records. Employees had been sharing login credentials. Sensitive data sat in plain text. Multi-factor
In 2024, the breach at Snowflake's customer environments didn't exploit some exotic zero-day vulnerability. Threat actors simply used stolen credentials — many of them passwords reused across services without multi-factor authentication. Over 165 organizations were impacted, including Ticketmaster and AT&T. The lesson was brutal and
The Email That Cost One Company $37 Million In 2024, a single phishing email led to a business email compromise attack against Orion SA, a Luxembourg-based metals trading company, resulting in a $60 million wire transfer to threat actor-controlled accounts. The company later recovered roughly $23 million. The email looked
