Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
A $150 Investment vs. a $4.24 Million Breach In March 2021, CNA Financial — one of the largest insurance companies in the U.S. — paid a reported $40 million ransom after a ransomware attack that started with a single employee interaction. That's not a typo. Forty million dollars
The SolarWinds Wake-Up Call for Every Boardroom When the SolarWinds breach came to light in December 2020, it didn't just compromise 18,000 organizations including multiple U.S. federal agencies. It put a spotlight on something security professionals have been shouting about for years: boards of directors are
In March 2021, the FBI's Internet Crime Complaint Center reported that business email compromise — the category that includes every CEO fraud email scam — generated $1.8 billion in reported losses in 2020 alone. That made it the single most financially damaging cybercrime category in the entire IC3 report,
When Marriott acquired Starwood Hotels in 2016, the deal looked solid on paper. Two years later, Marriott disclosed that hackers had been inside Starwood's reservation system since 2014 — exposing the personal data of up to 500 million guests. The breach predated the acquisition. The liability didn't.
In April 2021, researchers discovered a database of 533 million Facebook user records — names, phone numbers, email addresses — freely circulating on a dark web forum. That same month, a compilation of 3.2 billion email-password pairs called "COMB" surfaced, aggregated from years of breaches. Stolen credentials on the
23 Billion Stolen Credentials Are Circulating Right Now In 2020, Digital Shadows found more than 15 billion stolen credentials for sale on dark web markets — and that number has only climbed since. Every single one of those username-password pairs is ammunition for a credential stuffing attack. This isn't
In March 2021, Microsoft disclosed that the Hafnium threat actor group had exploited Exchange Server vulnerabilities — but what most people missed is that many of those compromised servers were initially discovered through brute force password spraying. The attackers didn't need a sophisticated zero-day for every target. They just
In January 2021, the FBI's Internet Crime Complaint Center reported that business email compromise — a form of account takeover — cost victims over $1.8 billion in 2020 alone. That made it the costliest category of cybercrime by a wide margin. Not ransomware. Not credit card fraud. Account takeover.
In March 2021, the FBI's Internet Crime Complaint Center reported that business email compromise and identity theft schemes cost U.S. organizations over $4.2 billion in 2020 alone — making it the single most expensive category of cybercrime. That number isn't slowing down. If you run
The Colonial Pipeline Attack Changed Everything In May 2021, a single compromised password led to the most disruptive cyberattack on U.S. critical infrastructure in history. DarkSide ransomware shut down Colonial Pipeline's 5,500-mile fuel system, triggering gas shortages across the eastern seaboard. The company paid a $4.
