Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
In February 2025, a finance employee at a Hong Kong multinational wired $25 million to threat actors after a deepfake video call impersonating the company's CFO. That single incident captures the state of social engineering attacks right now: they're sophisticated, they exploit trust instead of technology,
In September 2023, a threat actor called Scattered Spider called MGM Resorts' IT help desk, impersonated an employee they found on LinkedIn, and convinced a technician to reset credentials. The result: an estimated $100 million in losses, a ransomware lockout across casino floors and hotel systems, and weeks of
In January 2024, a finance employee at engineering firm Arup wired $25 million to threat actors after joining a video call with what appeared to be the company's CFO and other colleagues. Every person on that call was a deepfake. The attackers never exploited a software vulnerability. They
A Single Click Cost MGM Resorts $100 Million In September 2023, a social engineering phone call to an MGM Resorts IT help desk led to one of the most expensive breaches in hospitality history. The threat actor didn't exploit a zero-day vulnerability. They didn't write a
Last October Cost Companies $4.88 Million on Average That's the average cost of a data breach in 2024, according to IBM's Cost of a Data Breach Report. And most of those breaches started the same way — a human clicked something they shouldn't have.
The Breach That Cost a 12-Person Company $1.2 Million In early 2024, a small accounting firm in the Midwest lost $1.2 million after an employee clicked a phishing link disguised as a DocuSign notification. The attacker harvested credentials, bypassed the firm's basic email filters, and initiated
The Breach That Started With a 12-Minute Video Nobody Watched In early 2024, a mid-sized accounting firm in the Midwest suffered a ransomware attack that locked 14 years of client tax records. The entry point? A phishing email that an accounts payable clerk clicked without hesitation. The firm had online
In 2024, MGM Resorts lost an estimated $100 million after a threat actor called the help desk, impersonated an employee found on LinkedIn, and talked their way into a network reset. No zero-day exploit. No nation-state malware. Just a phone call. That single incident proved what I've been
In February 2024, Change Healthcare — a company that processes roughly one-third of all U.S. medical claims — was hit by the ALPHV/BlackCat ransomware group. The fallout was staggering: $872 million in direct costs reported by UnitedHealth Group in a single quarter, pharmacies unable to process prescriptions, and the personal
A Single Click That Cost a Hospital $22 Million In February 2024, Change Healthcare — the payment processing backbone for thousands of U.S. hospitals and pharmacies — was hit by the ALPHV/BlackCat ransomware group. UnitedHealth Group, its parent company, confirmed paying approximately $22 million in ransom. The attack disrupted prescription
