Security awareness tips, industry news, and product updates.
September brings the year's biggest wave of new starters - and attackers time their CEO impersonation campaigns to match. Why the first 90 days are the most phishable window of any tenure, and how to protect the whole incoming cohort.
Every back-to-school season brings a surge of phishing aimed at schools, universities and students - and the lures land in corporate inboxes too. What the latest data shows and how to prepare your workforce before the wave peaks.
NYDFS has told regulated financial entities, in writing, to train staff against help-desk vishing attacks. Combined with the fully effective Part 500 amendment and a record enforcement run, targeted social-engineering training is now a supervisory expectation in New York.
Attackers now purpose-build phishing for smartphones, where desktop email defenses cannot see and distracted users tap first. Research shows smishing drives 69.3 percent of mobile phishing - and iPhones are not the safe haven many assume.
New 2026 research shows malicious SVG attachments have grown fifty-fold, becoming the third most common malicious attachment type. Here is why an image file can phish you - and what to change in your filters, policies and simulations.
New 2026 survey data shows one in four Americans received an AI deepfake voice call in the past year - and nearly as many doubt they could spot one. The defense is a policy, not an ear.
The Luna Moth extortion crew escalated sharply in May and June 2026: an FBI FLASH alert, a leak site listing roughly 100 victims, reported $20 million ransom demands and attackers walking into law firm offices in person.
US tax-authority phishing surged over 400 percent in 2026, and fake ELSTER refund mails are landing while German employees file their 2025 returns. The core lesson for staff: the Finanzamt never emails your refund.
Microsoft has documented phishing campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek - lures built for employees who use AI tools every day. It is a new template family your simulations should cover.
Realistic phishing simulations only work if the emails actually arrive. empowsec provisions a dedicated, fully authenticated sending domain for every company in one click - SPF, DKIM and DMARC included - and tells you exactly which IPs to allow-list.
Phishing volume fell roughly 20 percent for two years running, but Zscaler's data shows attacks are now fewer, smarter, and aimed at routine business workflows. Falling numbers are not falling risk.
Google has filed a RICO lawsuit against the AI-powered 'Outsider' smishing network, exposing an industrialized text-scam economy that rents for 88 dollars a week. Here is what the case means for employee awareness on mobile.