Security awareness tips, industry news, and product updates.
Consent phishing tricks users into approving a malicious OAuth app — granting attackers token-based access to mail and files without ever touching a password or triggering MFA. Here is how it works and how to shut it down.
An 'rn' that reads as an 'm', an extra word, a wrong TLD — lookalike domains impersonate trusted brands in phishing and brand abuse. Here is how to spot them and the controls that blunt them.
The FBI's 2025 Internet Crime Report tallies a record $20.9 billion in losses, with business email compromise close to the top. Here's what the numbers mean and the controls that actually help.
Verizon's 2026 Data Breach Investigations Report puts the human element in 62% of breaches and confirms attackers are pivoting to mobile and the browser. Here's what it means for your awareness program.
Annual click-through training checks a compliance box but rarely changes behavior. Human Risk Management replaces it with continuous, data-driven, personalized risk reduction. Here is what that shift looks like in practice.
One click on a report button can turn every employee into a sensor and shrink an attacker's dwell time to minutes. Here is how to build the process and the blameless culture that make reporting reflexive.
New hires are eager to please, unfamiliar with the norms, and disproportionately targeted by BEC and impersonation scams. Their first 90 days are the riskiest. Here is how to build security into onboarding from day one.
Passwords and even push-based MFA keep falling to phishing. Passkeys close the door structurally because there is no shared secret to steal. Here is why they work and how to roll them out.
The FBI is warning fans that criminals are spoofing FIFA's ticketing site ahead of the 2026 World Cup. Here is why event-themed lures land in employee inboxes and how to train your team to spot them.
The FBI is warning about Kali365, a phishing-as-a-service platform that hijacks Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass MFA. Here's how the attack works and how to defend your organization.
Bitdefender's Operation Road Trap research shows how toll, parking, and traffic-fine smishing has scaled across countries. Here is what employees and security teams should watch for.
Microsoft is warning US organizations about a sophisticated code-of-conduct phishing campaign using PDFs, CAPTCHA gates, and AiTM token theft. Here is what security teams should watch for next.