Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
A Single Stolen Password Started a $4.4 Billion Problem In May 2021, a single compromised password shut down the Colonial Pipeline — the largest fuel pipeline in the United States. Fuel shortages hit the East Coast. Panic buying emptied gas stations across multiple states. The company paid a $4.4
The Threat Already Inside Your Building In January 2023, the FBI arrested a former GE Aviation employee who had spent years downloading thousands of proprietary turbine technology files and transferring trade secrets to a competing business in China. The insider had legitimate access. He passed every background check. He sat
The Threat Already Inside Your Building In 2022, a former employee at Cash App's parent company, Block, downloaded reports containing the personal information of 8.2 million customers — months after leaving the company. Block disclosed the breach in an SEC filing, and lawsuits followed. The attacker didn'
In 2022, a former employee at Cash App's parent company, Block Inc., downloaded reports containing the personal information of over 8 million customers — months after they'd left the company. The access was never revoked. No alarm was triggered. The breach wasn't discovered until the
One Employee Stole Data for Profit. The Other Just Clicked the Wrong Link. In 2022, a former employee of a major healthcare organization was sentenced to federal prison for stealing patient records and selling them. That same year, the Verizon Data Breach Investigations Report found that 82% of breaches involved
The Breach That Came From the Inside In 2022, a former Twitter employee was convicted of spying on behalf of Saudi Arabia, accessing the personal data of dissidents using nothing more than his legitimate credentials. No malware. No phishing email. Just an insider with access and motive. That case made
Your Home Office Is Now the Weakest Link In 2023, a single remote employee at MGM Resorts answered a social engineering call that led to a ransomware attack costing the company over $100 million in losses. The attacker didn't breach a firewall. They didn't exploit a
In early 2024, a finance employee at a multinational firm in Hong Kong joined a video call with what appeared to be the company's CFO and several colleagues. Every person on the call was a deepfake. The employee transferred $25.6 million to threat actors before anyone realized
In 2023, MGM Resorts lost roughly $100 million after a threat actor social-engineered their way past an IT help desk employee — with a single phone call. The attacker didn't exploit a zero-day vulnerability. They didn't brute-force a password. They just talked their way in. And the
A $1.3 Million Fine for Skipping the Basics In 2023, the U.S. Department of Health and Human Services fined Lafourche Medical Group $480,000 for a phishing attack that compromised nearly 35,000 patient records. The root cause wasn't a sophisticated zero-day exploit. It was the
