Discover resources and strategies for building effective security awareness training programs. Posts cover curriculum design, engagement techniques, compliance requirements, and methods for measuring training impact to reduce human-related security incidents across organizations.
posts
The Threat Already Inside Your Network In 2023, Tesla disclosed that two former employees had leaked the personal data of over 75,000 workers to a foreign media outlet. It wasn't a sophisticated nation-state hack. It wasn't a zero-day exploit. It was two people with legitimate
The Hiring Manager Who Ignored Every Applicant's Diploma A few years ago, I sat in on a hiring panel for a mid-level SOC analyst position. The hiring manager tossed a stack of resumes on the table and said, "I don't care what school any of
A Single Click Cost One Hospital System $67 Million In 2024, Change Healthcare — one of the largest health payment processors in the U.S. — was hit by the ALPHV/BlackCat ransomware group. The attack disrupted claims processing for thousands of providers nationwide. UnitedHealth Group, its parent company, reported costs exceeding
The $350 Million Checkbox That Wasn't Checked When Verizon acquired Yahoo in 2017, two massive data breaches — affecting all three billion Yahoo accounts — knocked $350 million off the purchase price. The breaches had happened years earlier, but inadequate cybersecurity due diligence meant the full scope wasn't
In 2023, MGM Resorts lost an estimated $100 million after a threat actor social-engineered a help desk employee with a ten-minute phone call. The attacker didn't exploit a zero-day vulnerability. They exploited a gap in employee policy — specifically, the identity verification process for password resets. A strong cybersecurity
The $55 Million Email That Fooled a CFO In 2024, the automotive parts manufacturer Scoular lost $17.2 million to a business email compromise scheme. But that wasn't even close to the record. Ubiquiti Networks lost $46.7 million. Austrian aerospace firm FACC lost $55.8 million — and
The Breach That Started With One Reused Password In 2023, a single employee at Norton LifeLock's parent company, Gen Digital, reused a personal password across multiple accounts. Attackers used credential stuffing to compromise nearly 925,000 customer accounts. One password. Nearly a million victims. If you've
In 2023, MGM Resorts lost an estimated $100 million after a social engineering attack opened the door to ransomware that crippled casino floors, hotel check-ins, and digital room keys for days. The attackers didn't use some exotic, never-before-seen weapon. They used well-known types of malware — the same categories
The Click That Cost One Company $47 Million In 2023, MGM Resorts was brought to its knees — not by a sophisticated zero-day exploit, but by a single social engineering phone call that led to credential theft. The resulting breach caused an estimated $100 million in damages. And it started with
Your Home Office Is Now the Attack Surface In 2023, a single remote employee at MGM Resorts answered a social engineering call from a threat actor impersonating IT support. That one interaction led to a ransomware attack that cost the company over $100 million in losses. The attacker didn'
