Articles by Rachel Andersen
NYDFS has told regulated financial entities, in writing, to train staff against help-desk vishing attacks. Combined with the fully effective Part 500 amendment and a record enforcement run, targeted social-engineering training is now a supervisory expectation in New York.
New 2026 research shows malicious SVG attachments have grown fifty-fold, becoming the third most common malicious attachment type. Here is why an image file can phish you - and what to change in your filters, policies and simulations.
Compliance frameworks expect regular, evidenced security training - but manual re-enrollment does not scale. empowsec automation rules enroll new hires automatically and re-run courses every 3, 6, 12 or 24 months, hands-off.
KnowBe4's 2026 industry benchmark puts the untrained phishing click rate at 33.2 percent - and shows a year of continuous training cuts it to 4.2 percent. Here is how to benchmark your own organization.
empowsec bundles features into plans, charges seat-based billing through Stripe, and reconciles seat overages with a transparent true-up process - so your organization can grow without hard blocks or billing surprises.
empowsec's premium reseller video library lets MSPs upload, manage, and deliver their own branded training videos - with interactive quiz-style questions, multi-language support, a publish/retire workflow, and CDN delivery to client companies.
empowsec's reseller white-label capability lets MSPs and resellers fully rebrand the platform - logo, favicon, colors, and theme - and serve it from their own custom domain so the platform becomes their own product in the eyes of every client.
empowsec gives resellers and MSPs a single management console to provision companies, allocate seats, control feature access, and report across every client - making it practical to deliver professional security awareness training at scale.
Reused passwords plus breached credentials are the fuel behind account takeover. Here is how to roll out password managers and build credential hygiene that actually holds across your organization.
Compromised browser extensions are quietly stealing session cookies and tokens - and stolen sessions sail right past passwords and MFA. Here's why attackers are living in the browser, and how to govern extensions.
A threatening email claims to have webcam footage and demands Bitcoin — and it even quotes one of your old passwords. Here is why these extortion scams are almost always empty bluffs, and how to help employees respond calmly.
One compromised chatbot integration exposed 700+ organizations through stolen OAuth tokens. The Salesloft Drift attack shows why third-party access is now your biggest blind spot.