Security awareness tips, industry news, and product updates.
October's Cybersecurity Awareness Month is won or lost in September. A practical four-week preparation plan covering goals, a baseline phishing simulation, the content calendar, executive sponsorship and how you will measure success.
HHS has pushed final action on the proposed HIPAA Security Rule overhaul to July 2027, and more than 100 hospital systems want it withdrawn entirely. But the current rule remains actively enforced, including its security awareness training requirement. Relaxing now is the wrong lesson.
September brings the year's biggest wave of new starters - and attackers time their CEO impersonation campaigns to match. Why the first 90 days are the most phishable window of any tenure, and how to protect the whole incoming cohort.
Security budget growth has slowed to a five-year low, and every line item now needs hard numbers behind it. Here is the ROI evidence CISOs and MSPs can use to defend - and grow - the human risk budget this planning season.
New global research shows 45% of SMBs suffered a cyber-incident in the past year, yet 75% feel confident in their resilience - and confidence actually rises among repeat victims. What the confidence paradox means for MSPs selling security awareness.
Push bombing turns the employee habit of tapping 'Approve' into a breach vector. The fix pairs number matching and phishing-resistant MFA with one trained rule: never approve a prompt you did not trigger.
Germany's new BSIG makes cybersecurity training a personal, non-delegable duty for the management of regulated entities, backed by personal liability for oversight failures. The BSI has now spelled out what the training must cover and recommends an annual cadence.
The empowsec learner dashboard gives every employee a personal training overview: pending and overdue assignments, per-course progress, and recent completions - so nobody has to guess what to do next.
Every other EU AI Act headline in 2026 has been about delay, but the Article 4 AI-literacy duty was never postponed. It has applied since February 2025, and from early August 2026 national authorities gain the powers to enforce it. Here is how to build a defensible program.
empowsec lets companies and resellers fork any global course into an editable copy - quizzes, interactive pages, and settings included - then sync with upstream updates or delete the fork to revert, while learners always see the most specific version.
US tax-authority phishing surged over 400 percent in 2026, and fake ELSTER refund mails are landing while German employees file their 2025 returns. The core lesson for staff: the Finanzamt never emails your refund.
Microsoft has documented phishing campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek - lures built for employees who use AI tools every day. It is a new template family your simulations should cover.