Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
The Fine That Changed Everything for One Healthcare Provider In October 2020, the U.S. Department of Health and Human Services fined Premera Blue Cross $6.85 million after a data breach exposed 10.4 million records. The root cause wasn't some exotic zero-day exploit. It was a
When Colonial Pipeline shut down 5,500 miles of fuel infrastructure in May 2021 due to a single compromised password, it wasn't a failure of technology. It was a failure of framework. The company lacked the layered defenses, detection capabilities, and response plans that the NIST Cybersecurity Framework
The FTC Just Fined a Company $5 Billion. Are You Next? In 2019, the FTC levied a record-breaking $5 billion penalty against Facebook for privacy violations. That number made headlines, but here's what most business owners missed: the FTC doesn't just go after tech giants. They
In October 2020, the FBI, CISA, and HHS issued a joint advisory warning of an "imminent and increased" threat of ransomware attacks against U.S. hospitals. Within weeks, Universal Health Services — a Fortune 500 hospital chain operating 400 facilities — confirmed a Ryuk ransomware attack that forced staff to
The Industry That Loses More Per Breach Than Any Other In 2021, a single ransomware attack against CNA Financial reportedly led to a $40 million ransom payment — one of the largest ever disclosed. That incident wasn't an anomaly. It was a signal. Cybersecurity for financial services isn'
Why Threat Actors Love Targeting Law Firms In February 2021, the law firm Jones Day confirmed that hackers had stolen confidential client data through a vulnerability in Accellion's file-transfer appliance. Sensitive case documents, including those related to major corporate litigation, ended up on the Clop ransomware gang'
The Blackbaud Breach Should Have Been a Wake-Up Call In May 2020, a ransomware attack hit Blackbaud — one of the largest cloud computing providers serving nonprofits, hospitals, and universities. The breach exposed donor records, financial data, and Social Security numbers belonging to millions of people across hundreds of organizations. Blackbaud
A Single Checkbox Left Unchecked Cost Capital One $80 Million In 2019, a former AWS employee exploited a misconfigured web application firewall to access over 100 million Capital One customer records. The breach led to an FTC investigation, an $80 million fine from the OCC, and a $190 million class-action
The Misconfiguration That Exposed 3.8 Billion Records In June 2021, researchers discovered an unsecured Elasticsearch instance containing 3.8 billion records — names, emails, phone numbers, and social media profiles compiled from scraped and breached data. It sat wide open on the internet. No password. No access controls. Just a
In April 2021, the FBI's IC3 reported a sharp rise in mobile-focused phishing attacks — schemes specifically designed to exploit the smaller screens and always-on nature of smartphones. I've watched organizations pour millions into securing their perimeters while ignoring the devices employees actually use the most. The
