Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
The SEC Made It Official — Boards Can't Plead Ignorance Anymore In July 2023, the SEC adopted rules requiring public companies to disclose material cybersecurity incidents within four business days and to describe their board's oversight of cyber risk annually. That wasn't a suggestion. It
The Framework 80% of Organizations Reference — But Few Actually Implement When Change Healthcare suffered its catastrophic ransomware attack in early 2024, disrupting pharmacy operations for millions of Americans, the post-incident analysis pointed to gaps that the NIST Cybersecurity Framework was specifically designed to prevent. Missing multi-factor authentication on a critical
Why Threat Actors Love Targeting Law Firms In 2023, the international firm Bryan Cave Leighton Paisner disclosed a breach that exposed personal data of over 50,000 individuals — many of them clients of major corporations the firm represented. The attackers didn't need to hack every Fortune 500 company
A Single Email Cost This Company $47 Million In 2015, Ubiquiti Networks disclosed that threat actors impersonating senior executives tricked finance employees into wiring $46.7 million to overseas accounts controlled by attackers. No malware. No zero-day exploit. Just a convincing email that looked like it came from the CEO.
A Single Checkbox Left Unchecked Cost Them Everything In 2023, Toyota disclosed that a cloud misconfiguration had exposed the location data of 2.15 million customers for over a decade. Not a sophisticated zero-day exploit. Not a nation-state threat actor. A misconfigured cloud database left publicly accessible because someone didn&
The Phone Call That Cost One Company $23 Million In early 2024, a finance employee at a multinational firm in Hong Kong joined a video call with what appeared to be the company's CFO and several colleagues. Every person on the screen was a deepfake. The employee transferred
In 2023, the FBI's Internet Crime Complaint Center received over 880,000 complaints with potential losses exceeding $12.5 billion — and malware was the engine behind a staggering share of those incidents. If you've ever asked what is malware, the textbook answer is simple: malicious software
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. Behind nearly every one of those complaints was a single moment: someone clicked a link they shouldn't have. If you&
In 2023, a mid-size healthcare company discovered that an employee had been syncing patient records to a personal Dropbox account for two years. The data breach affected over 30,000 patients and triggered a HIPAA investigation. The employee wasn't malicious — they just wanted an easier way to work
Your Employees' Passwords Are Probably Already There In 2024, the FBI's Internet Crime Complaint Center reported over $16 billion in losses from cybercrime — and a staggering amount of that activity traces back to marketplaces most people never see. If you've ever wondered what is the
