Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
In January 2022, the FBI issued a public warning that the cybercriminal group FIN7 had been mailing malicious USB drives — disguised as gift cards and COVID-19 guidelines — directly to U.S. companies. The drives contained ransomware. Employees plugged them in. Networks fell. That campaign wasn't some edge case
The Server Room Door Was Unlocked In 2019, a penetration tester hired by the state of Iowa walked into the Dallas County Courthouse after hours. He accessed restricted areas, took photos of sensitive systems, and demonstrated just how easy it was to bypass physical controls. The exercise ended with him
In 2019, a penetration tester hired by the state of Iowa walked into a locked courthouse after hours simply by following an employee through a secured door. He was arrested — despite being under contract to test exactly that vulnerability. The incident made national headlines and exposed an uncomfortable truth: a
A former employee at a financial services firm in Chicago watched his coworker type her password every morning for two weeks. He memorized it character by character. After he was terminated for performance issues, he used those stolen credentials to access the company's client database from a public
The Sticky Note That Cost a Hospital $1.2 Million A few years ago, I walked into a client's office for a security assessment and found a sticky note on a monitor in the billing department. It had a username, a password, and the name of their patient
The Breach That Started With a Single Slack Message In September 2022, a threat actor sent a series of social engineering messages to an Uber employee, eventually convincing them to approve a multi-factor authentication push notification. That single lapse gave the attacker access to internal systems, Slack channels, and admin
A Fortune 500 Company Got Breached by a Phone Call In September 2023, a threat actor called MGM Resorts' IT help desk, impersonated an employee found on LinkedIn, and convinced a technician to reset credentials. The result? Over $100 million in losses, days of operational chaos, and a stock
When the SEC fined SolarWinds' CISO for misleading investors about cybersecurity practices, it sent a shockwave through every security department in America. The message was unmistakable: vague assurances about security posture aren't enough anymore. Boards, regulators, and cyber insurers now demand evidence. That's why security
Your Training Program Is Worthless Without Proof In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that started with a single phone call to the help desk. The company almost certainly had a security awareness program in place. So did Caesars Entertainment, which paid a
A 45-Minute Training Video Never Stopped a Breach In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that started with a phone call to the help desk. The attacker didn't exploit a zero-day vulnerability. They exploited a human. And I guarantee every employee
