Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
In 2024, Verizon's Data Breach Investigations Report found that email was the initial attack vector in roughly 25% of all confirmed data breaches. Not novel zero-days. Not sophisticated nation-state implants. Spam email — the oldest trick in the book — still opens the door for threat actors more than any
The Phone Call That Cost One Company $25 Million In early 2024, a finance worker at engineering firm Arup was tricked into transferring $25 million after a video call with what appeared to be the company's CFO. Every person on that call was a deepfake. The attackers never
A Single Fake Identity Website Cost One Company $23 Million In early 2024, a finance employee at Arup, a British engineering firm, was tricked into transferring approximately $25 million after threat actors used a deepfake video call combined with a fake identity website that impersonated senior executives. The site looked
In 2022, a former Amazon engineer named Paige Thompson was convicted for the Capital One breach that exposed over 100 million customer records. She wasn't an outside hacker who cracked through a firewall. She was an insider — someone with knowledge of the cloud infrastructure who exploited a misconfigured
23andMe Lost Everything — Starting with Recycled Passwords In October 2023, genetic testing company 23andMe confirmed that a credential stuffing attack compromised roughly 6.9 million user accounts. Attackers didn't exploit a zero-day vulnerability or deploy sophisticated malware. They simply took usernames and passwords stolen from other breaches and
The Breach That Came From the Corner Office In 2022, a former Pfizer employee downloaded over 12,000 files — including trade secrets and COVID-19 vaccine data — to a personal Google Drive account before jumping to a competitor. The company didn't catch it until weeks later. No external hacker.
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. I've investigated phishing incidents at organizations of every size, from ten-person startups to Fortune 500 companies. The pattern is always
In January 2024, researchers discovered a file called "Naz.API" circulating on dark web forums. It contained over 70 million unique email addresses and their associated passwords — harvested from credential-stealing malware installed on everyday computers. Most of the victims had no idea their login information was for sale.
In 2023, MGM Resorts had a multi-billion dollar security stack — endpoint detection, firewalls, SIEM platforms, the works. A single social engineering phone call bypassed all of it. The attackers impersonated an employee, convinced the IT help desk to reset credentials, and caused an estimated $100 million in damages. If you
The Breach That Started With a Forgotten SaaS App In 2023, a Salesforce misconfiguration exposed sensitive data at multiple government agencies and financial institutions. The root cause wasn't sophisticated malware or a zero-day exploit. It was a permissions setting that nobody reviewed after initial deployment. That single oversight
