Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
The Sticky Note That Cost a Hospital $1.2 Million A few years ago, I walked into a client's office for a security assessment and found a sticky note on a monitor in the billing department. It had a username, a password, and the name of their patient
The Breach That Started With a Single Slack Message In September 2022, a threat actor sent a series of social engineering messages to an Uber employee, eventually convincing them to approve a multi-factor authentication push notification. That single lapse gave the attacker access to internal systems, Slack channels, and admin
A Fortune 500 Company Got Breached by a Phone Call In September 2023, a threat actor called MGM Resorts' IT help desk, impersonated an employee found on LinkedIn, and convinced a technician to reset credentials. The result? Over $100 million in losses, days of operational chaos, and a stock
When the SEC fined SolarWinds' CISO for misleading investors about cybersecurity practices, it sent a shockwave through every security department in America. The message was unmistakable: vague assurances about security posture aren't enough anymore. Boards, regulators, and cyber insurers now demand evidence. That's why security
Your Training Program Is Worthless Without Proof In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that started with a single phone call to the help desk. The company almost certainly had a security awareness program in place. So did Caesars Entertainment, which paid a
A 45-Minute Training Video Never Stopped a Breach In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack that started with a phone call to the help desk. The attacker didn't exploit a zero-day vulnerability. They exploited a human. And I guarantee every employee
A $4.88 Million Average — and a Training Budget That's a Fraction of That IBM's 2024 Cost of a Data Breach Report pegged the global average breach cost at $4.88 million. That same report found that organizations with high levels of security training and awareness
A Single Email Cost This Company $47 Million In 2015, Ubiquiti Networks disclosed that attackers impersonating company executives tricked finance employees into wiring $46.7 million to overseas accounts controlled by threat actors. No malware. No zero-day exploit. Just a carefully crafted CEO fraud email scam that exploited trust, urgency,
The CEO Who Wired $47 Million to a Threat Actor In 2016, Austrian aerospace manufacturer FACC fired its CEO after the company lost €42 million (roughly $47 million) in a business email compromise attack. A threat actor impersonated the CEO via email and convinced a finance employee to wire funds
In December 2020, security firm FireEye discovered that a routine software update from SolarWinds had been weaponized to infiltrate roughly 18,000 organizations — including the U.S. Treasury, the Department of Homeland Security, and multiple Fortune 500 companies. The attackers didn't kick down the front door. They walked
