Security awareness tips, industry news, and product updates.
Push bombing turns the employee habit of tapping 'Approve' into a breach vector. The fix pairs number matching and phishing-resistant MFA with one trained rule: never approve a prompt you did not trigger.
Germany's new BSIG makes cybersecurity training a personal, non-delegable duty for the management of regulated entities, backed by personal liability for oversight failures. The BSI has now spelled out what the training must cover and recommends an annual cadence.
The empowsec learner dashboard gives every employee a personal training overview: pending and overdue assignments, per-course progress, and recent completions - so nobody has to guess what to do next.
Every other EU AI Act headline in 2026 has been about delay, but the Article 4 AI-literacy duty was never postponed. It has applied since February 2025, and from early August 2026 national authorities gain the powers to enforce it. Here is how to build a defensible program.
empowsec lets companies and resellers fork any global course into an editable copy - quizzes, interactive pages, and settings included - then sync with upstream updates or delete the fork to revert, while learners always see the most specific version.
US tax-authority phishing surged over 400 percent in 2026, and fake ELSTER refund mails are landing while German employees file their 2025 returns. The core lesson for staff: the Finanzamt never emails your refund.
Microsoft has documented phishing campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek - lures built for employees who use AI tools every day. It is a new template family your simulations should cover.
Infostealer malware harvested more than 1.8 billion credentials in six months, and stolen session cookies now let attackers walk past MFA. The infection almost always starts with one human decision.
Detailed out-of-office auto-replies hand attackers absence dates, deputy contacts, and reporting lines - exactly when SOC staffing is thinnest. How to write OOO messages that say less, and why August deserves its own simulation.
Germany's BSI warns travelers about fake booking confirmations as Check Point measures a 122 percent three-year surge in travel sector attacks. Vacation phishing hits personal devices that also carry corporate mail - making it a workplace problem.
KnowBe4's 2026 industry benchmark puts the untrained phishing click rate at 33.2 percent - and shows a year of continuous training cuts it to 4.2 percent. Here is how to benchmark your own organization.
empowsec supports time-based one-time password (TOTP) two-factor authentication so that even a stolen password cannot open an account. Here is how it works and why it matters for every security-conscious organization.