Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
In March 2024, the FBI's IC3 reported that Americans lost over $45 million to smishing and vishing schemes in a single year — and those are just the cases people actually reported. I've personally investigated incidents where a single SMS message led to a six-figure wire transfer
A Single Email Cost This Company $100 Million In 2015, Ubiquiti Networks disclosed that threat actors used carefully crafted emails impersonating company executives to trick finance employees into wiring $46.7 million to overseas accounts. The attackers didn't use malware. They didn't exploit a software vulnerability.
The USB Drive in the Parking Lot Still Works In 2023, the U.S. Department of Health and Human Services warned healthcare organizations about a resurgence of USB-based attacks — threat actors dropping infected flash drives in parking lots, lobbies, and break rooms. People still plug them in. That single act
Your Home Office Is a Threat Actor's Favorite Target In 2023, a single remote employee at MGM Resorts answered a social engineering call that led to a ransomware attack costing the company over $100 million. The attacker didn't breach a firewall. They didn't exploit
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. And those are just the ones people actually reported. I've spent years helping organizations recover from phishing attacks, and I
In 2024, the average cost of a data breach hit $4.88 million globally, according to IBM's Cost of a Data Breach Report. That number hasn't gone down. If you're responsible for cyber security at any level — whether you're a CISO, an
A financial analyst at a Fortune 500 company typed her corporate credentials into a laptop at Chicago O'Hare. The man sitting two seats behind her wasn't reading the news on his phone — he was recording her screen. Within 48 hours, the attacker used those stolen credentials
One Phishing Email Cost This Company $100 Million In 2023, MGM Resorts was brought to its knees — not by a sophisticated zero-day exploit, but by a phishing email and a follow-up phone call. Threat actors from the Scattered Spider group used social engineering to trick an IT help desk employee,
In March 2024, a threat actor breached a major healthcare provider's network using a single compromised password — no second factor required. The organization had purchased MFA licenses two years prior but never enforced enrollment. That gap cost them months of remediation and exposed the records of over 100,
In January 2024, the SEC's official X (formerly Twitter) account was hijacked after a threat actor convinced a mobile carrier to transfer the agency's phone number to a new SIM card. The attacker used SMS verification codes to reset the password and post a fake announcement
