Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
In 2023, a single MOVEit vulnerability gave threat actors access to data from over 2,500 organizations — and financial institutions were among the hardest hit. Banks, credit unions, wealth management firms, and insurance companies collectively reported hundreds of millions of compromised records. If you work in finance, you already know
In 2023, the FBI's Internet Crime Complaint Center received over 880,000 complaints with potential losses exceeding $12.5 billion — a 22% increase in losses over the previous year. And those are just the incidents that were actually reported. In my experience, for every cyber incident that gets
In 2024, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — making it the most reported cybercrime category for the fifth consecutive year. Despite billions spent on security tools, phishing remains the number one way threat actors break into organizations. So let's actually
82% of Phishing Sites Now Target Mobile Devices In 2024, Zimperium's Global Mobile Threat Report found that 82% of phishing sites specifically targeted mobile devices. That number didn't surprise me. What surprised me was how many security teams I spoke with still treated mobile phishing attacks
The Average Company Uses 130 SaaS Apps — And Secures Maybe Half When I audited a mid-size financial services firm last year, they believed they had about 40 SaaS applications in production. The real number was 187. Over half were adopted by individual departments without IT's knowledge. Three of
A $1.3 Million Fine for Skipping Training In 2023, the U.S. Department of Health and Human Services fined Lafourche Medical Group $480,000 after a phishing attack compromised nearly 35,000 patient records. The investigation didn't just find a technical failure — it found the practice had
The CEO Who Wired $47 Million to a Stranger In 2016, FACC, an Austrian aerospace parts manufacturer, lost €42 million (roughly $47 million) after a threat actor impersonated the company's CEO via email and instructed an employee to wire funds for a fake acquisition project. The CEO and
In 2023, the FBI's Internet Crime Complaint Center received over 298,000 phishing complaints — more than any other cybercrime category. That number has only climbed since. I've investigated breaches at organizations of every size, and the entry point is almost always the same: one employee who
In 2023, MGM Resorts lost an estimated $100 million after a threat actor called Scattered Spider social-engineered their way past the help desk with a single phone call. But that attack started the way most do — with a phishing attack that gathered the intelligence needed to make that call convincing.
The Breach That Started With a Single Reused Password In 2024, Change Healthcare suffered a ransomware attack that disrupted pharmacy operations across the entire United States. The root cause? Compromised credentials on a remote access system that lacked multi-factor authentication. One account. No MFA. Billions of dollars in damage. I&
