Find practical strategies for defending against social engineering attacks at both the individual and organizational level. Content covers awareness training techniques, verification protocols, policy development, and building a security-first culture that resists manipulation attempts.
posts
In September 2023, a teenager used a phone call to trick an MGM Resorts employee into resetting credentials. That single social engineering attack cost MGM an estimated $100 million. No malware exploit. No zero-day vulnerability. Just a convincing voice on the other end of a help desk line. If you
MGM Resorts lost an estimated $100 million in September 2023 because a threat actor called an IT help desk, impersonated an employee, and talked their way into a privileged account. No zero-day exploit. No nation-state malware. Just a phone call and a human who hadn't been trained to
In 2022, a single employee at Twilio clicked a phishing link embedded in a fake IT notification. That one click gave threat actors access to internal systems and exposed data tied to over 130 organizations. The root cause wasn't a firewall failure or a zero-day exploit — it was
In March 2021, a single employee at a water treatment plant in Oldsmar, Florida clicked through a remote access session that could have poisoned a city's water supply. The attacker gained entry through a shared TeamViewer password — no phishing email required. The incident raised a question that boardrooms
In March 2021, a mid-size law firm in Atlanta lost $2.3 million to a single wire fraud attack. The attacker spoofed the managing partner's email, requested an urgent transfer, and a paralegal complied without hesitation. When the firm investigated, they discovered their annual security awareness program consisted
Colonial Pipeline just shut down 5,500 miles of fuel infrastructure this week. One compromised password. That's all it took. While forensic details are still emerging, the early reporting points to a single set of stolen credentials — likely obtained through a social engineering attack on an employee. If
In July 2020, a 17-year-old from Florida convinced Twitter employees to hand over internal credentials. Within hours, the accounts of Barack Obama, Elon Musk, Joe Biden, and Apple were all posting Bitcoin scam messages. The attacker didn't exploit a software vulnerability. He exploited people. These social engineering examples
Most Security Quizzes Are a Waste of Everyone's Time I recently reviewed the cybersecurity training program at a mid-size financial services firm that had been breached through a credential theft phishing email. They had a training program. They had quizzes. Every employee passed with flying colors — 95% average
One Click Cost Them $100 Million In 2023, MGM Resorts was brought to its knees — not by a sophisticated zero-day exploit, but by a phone call. A threat actor called the help desk, impersonated an employee found on LinkedIn, and gained access to internal systems. The resulting ransomware attack cost
The Breach That Bankrupted a 40-Person Company In 2023, a small accounting firm in Sacramento lost every client record it had. A single employee clicked a phishing link disguised as a DocuSign notification. Within 72 hours, a threat actor had deployed ransomware across the entire network. The firm paid $350,
