Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
The $5.6 Billion Warning the FTC Already Sent You In 2023, the FTC reported collecting over $5.6 billion in consumer refunds from enforcement actions — a significant chunk tied to data security failures. If you think the FTC only goes after big tech, think again. They've pursued
The Typo That Costs Billions: Why "Phising" Lands You Here Here's something I find fascinating — "phising" is one of the most commonly misspelled cybersecurity terms on the internet. If you searched for it, you're in exactly the right place. Phishing (with the
The Breach That Changed How I Think About Cyber Security In February 2024, Change Healthcare suffered a ransomware attack that disrupted insurance claims processing for millions of Americans. UnitedHealth Group confirmed paying a $22 million ransom. The attack vector? Stolen credentials on a system that lacked multi-factor authentication. One missing
A Poster on the Breakroom Wall Never Stopped a Breach In 2023, MGM Resorts lost an estimated $100 million after a threat actor called the help desk, impersonated an employee found on LinkedIn, and talked their way into the network. No zero-day exploit. No nation-state malware. Just a phone call.
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called a help desk, impersonated an employee found on LinkedIn, and talked their way into the network. No zero-day exploit. No nation-state tooling. Just a phone call. If you want to understand what causes a data breach,
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered their way past an IT help desk — with a single phone call. That one interaction led to a ransomware attack that shut down slot machines, hotel check-ins, and digital key cards across Las
The Redundancy in "Computer Security Security" Is the Whole Point When the Colonial Pipeline ransomware attack shut down fuel distribution across the U.S. Southeast in 2021, the root cause wasn't exotic. It was a single compromised VPN credential without multi-factor authentication. One layer failed, and
A Single Email Cost This Company $100 Million In 2015, Ubiquiti Networks disclosed that threat actors used carefully crafted emails — impersonating executives — to trick finance employees into wiring $46.7 million to overseas accounts. That wasn't a mass spam campaign. It was spear phishing: a surgical, researched, devastatingly
A Single Click Cost One Hospital Chain $100 Million In 2024, Change Healthcare — the largest health payment processing company in the U.S. — was hit by the ALPHV/BlackCat ransomware gang. The attack disrupted claims processing for thousands of providers nationwide. UnitedHealth Group, Change Healthcare's parent company, disclosed
A Leaderboard Didn't Stop the Breach — But It Helped In 2023, a midsize healthcare provider ran a standard annual compliance video for security training. Completion rates hit 94%. Two months later, a single employee clicked a phishing link that led to a ransomware attack affecting 130,000 patient
