Security awareness tips, industry news, and product updates.
Germany's BSI warns travelers about fake booking confirmations as Check Point measures a 122 percent three-year surge in travel sector attacks. Vacation phishing hits personal devices that also carry corporate mail - making it a workplace problem.
Menlo Security's 2026 Browser Threat Report finds one in five clicked phishing links goes completely undetected by URL filtering, and a third of evasive threats come from 'trusted' domains. The data-driven case for trained humans as the last line of defense.
When an employee clicks a simulated phishing link, empowsec turns the mistake into an instant micro-lesson: a Teachable Moment page that explains the exact red flags they just missed, at the moment they are most receptive to learning.
A vishing crew is calling employees as fake Microsoft IT staff and walking them through a bogus Entra passkey enrollment - then registering the attacker's own passkey for persistent access. The weak point is the enrollment moment, not the passkey.
Microsoft is warning of a surge in ACR Stealer infections across its enterprise customers, driven by the ClickFix lure that tricks employees into pasting a malicious command themselves. Here is how the attack works - and why the fix is as much about training as it is about tooling.
North Korean operatives are using deepfakes and synthetic identities to get hired at Western firms. Unit 42 built a convincing fake candidate in about 70 minutes. Here is how to vet remote hires.
empowsec's Outlook add-in gives employees a one-click 'Report phishing' button in their inbox - capturing email headers and content for review while instantly rewarding employees who correctly identify a simulation.
Thread hijacking lets attackers reply inside a real email conversation, with a familiar subject, history, and trusted sender. It defeats the 'unknown sender' instinct. Here is how to spot it.
Attackers are buying ads and gaming search results so the top hit for popular software is a trojanized download. Here's how malvertising and SEO poisoning infect employees - and how to train against it.
Attackers are phishing payroll portal logins and impersonating staff to reroute direct-deposit paychecks into accounts they control. The FBI has warned about it for years - here's how HR can stop it.
Phishing has moved out of the inbox and into Microsoft Teams, Slack, and calendar invites — platforms employees trust by default. Here is how the attacks work and how to extend your defenses to cover them.
"Are you available? I need a quick favor." It's the opening line of a gift card scam impersonating your CEO - low-tech, high-volume, and aimed at new and junior staff. Here's the pattern and the one rule that stops it.