Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
A hiring manager at a Fortune 500 company recently told me something that would make most college admissions officers uncomfortable: "I've hired analysts with no degree who outperformed candidates with a master's." That's not an argument against education — it's a
A $100,000 Antivirus Setup That Stopped Nothing I worked with an organization in 2024 that had invested heavily in computer security software — endpoint detection, next-gen firewalls, SIEM, the works. They still got hit with a ransomware attack that encrypted 14,000 files and shut down operations for nine days.
A Google Developer Nearly Lost Everything to a Fake Support Call In early 2025, a well-known Google developer publicly documented how he nearly fell for a sophisticated phishing attack targeting his Gmail account. The caller ID showed a legitimate Google phone number. The voice on the other end sounded professional,
The Breach That Didn't Start With You In 2023, the MOVEit Transfer vulnerability didn't just hit one company — it cascaded through thousands of organizations that trusted a single vendor's file transfer software. Clop ransomware operators exploited the flaw, and suddenly organizations like the BBC,
A $4.88 Million Problem With a Training-Shaped Solution IBM's 2024 Cost of a Data Breach Report put the global average breach cost at $4.88 million. That number alone should end every budget debate about security awareness programs. But I still sit in meetings where executives ask
In January 2024, a massive dataset called "Naz.API" surfaced on dark web forums containing over 70 million unique email addresses and their associated passwords. Many of these credentials were still active. The breach wasn't the result of one sophisticated attack — it was an aggregation of
In September 2023, a threat actor called Scattered Spider social-engineered their way into MGM Resorts by calling the company's IT help desk. One phone call. That's all it took to trigger a shutdown that cost MGM an estimated $100 million. No zero-day exploit. No sophisticated malware.
The Framework Nobody Reads But Everyone Claims to Follow I once walked into a mid-sized financial firm that proudly declared on their website they were "aligned with NIST standards." Thirty minutes into the assessment, I found admin passwords on sticky notes, no multi-factor authentication on critical systems, and
A Single Phone Call Cost MGM Resorts $100 Million In September 2023, a threat actor called MGM Resorts' IT help desk, impersonated an employee found on LinkedIn, and convinced a technician to reset credentials. That one vishing call triggered a ransomware attack that shut down slot machines, hotel key
In 2023, MGM Resorts lost roughly $100 million after a threat actor called Scattered Spider impersonated an employee on a help desk call — a textbook spear phishing technique that bypassed every technical control the company had. The attacker didn't blast out a million generic emails. They researched one
