Security awareness tips, industry news, and product updates.
New 2026 research shows malicious SVG attachments have grown fifty-fold, becoming the third most common malicious attachment type. Here is why an image file can phish you - and what to change in your filters, policies and simulations.
Realistic phishing simulations only work if the emails actually arrive. empowsec provisions a dedicated, fully authenticated sending domain for every company in one click - SPF, DKIM and DMARC included - and tells you exactly which IPs to allow-list.
Detailed out-of-office auto-replies hand attackers absence dates, deputy contacts, and reporting lines - exactly when SOC staffing is thinnest. How to write OOO messages that say less, and why August deserves its own simulation.
empowsec supports time-based one-time password (TOTP) two-factor authentication so that even a stolen password cannot open an account. Here is how it works and why it matters for every security-conscious organization.
empowsec offers eight free public security tools - no account required. From password strength testing to live email authentication checks, these tools give anyone a quick way to spot weaknesses and illustrate the kind of awareness empowsec builds across an entire organization.
When employees report suspicious emails through the empowsec Outlook or Gmail add-in, those reports land in an admin review queue where security teams can classify each one and build real threat intelligence from what is actually reaching inboxes.
empowsec's Outlook add-in gives employees a one-click 'Report phishing' button in their inbox - capturing email headers and content for review while instantly rewarding employees who correctly identify a simulation.
Thread hijacking lets attackers reply inside a real email conversation, with a familiar subject, history, and trusted sender. It defeats the 'unknown sender' instinct. Here is how to spot it.
An 'rn' that reads as an 'm', an extra word, a wrong TLD — lookalike domains impersonate trusted brands in phishing and brand abuse. Here is how to spot them and the controls that blunt them.
empowsec tracks every step of a simulated phishing attack - from the pixel that records an open to the fake login form that records a credential submission - and turns each event into a learning opportunity.
empowsec's phishing template library lets you build, translate, import, and export realistic lure emails - so every simulation reaches each employee in their own language.
Phishing simulation campaigns let you measure and improve how your employees respond to real-world lures - safely, at scale, and with the data to prove it is working.