Security awareness tips, industry news, and product updates.
HHS has pushed final action on the proposed HIPAA Security Rule overhaul to July 2027, and more than 100 hospital systems want it withdrawn entirely. But the current rule remains actively enforced, including its security awareness training requirement. Relaxing now is the wrong lesson.
On November 10, 2026, CMMC Phase 2 begins: DoD contracts involving CUI can require third-party Level 2 certification instead of self-assessment. With roughly 80,000 companies needing certification and only about 80 authorized assessors, the countdown is very real.
Push bombing turns the employee habit of tapping 'Approve' into a breach vector. The fix pairs number matching and phishing-resistant MFA with one trained rule: never approve a prompt you did not trigger.
Germany's new BSIG makes cybersecurity training a personal, non-delegable duty for the management of regulated entities, backed by personal liability for oversight failures. The BSI has now spelled out what the training must cover and recommends an annual cadence.
Annual compliance training looks tidy on a spreadsheet, but the forgetting curve erases most of it within weeks. Here is why continuous, adaptive security awareness training drives durable behavior change.
In 2026, no MFA can mean no coverage, and underwriters now want documented awareness training and phishing simulations too. Here is what insurers look for and how to evidence it.
DORA is best known for ICT risk and incident reporting, but it also makes security awareness training a compulsory module for staff and management. Here is what financial entities must do, and how to evidence it.
ISO/IEC 27001:2022 expects more than a once-a-year slideshow. Here is what the standard actually requires for security awareness, and how to prove it to your auditor.
PCI DSS v4.0 raised the bar for security awareness, naming phishing and social engineering explicitly. Here is what the standard now requires if you handle card data.
Verizon's 2026 Data Breach Investigations Report puts the human element in 62% of breaches and confirms attackers are pivoting to mobile and the browser. Here's what it means for your awareness program.
Annual click-through training checks a compliance box but rarely changes behavior. Human Risk Management replaces it with continuous, data-driven, personalized risk reduction. Here is what that shift looks like in practice.
New hires are eager to please, unfamiliar with the norms, and disproportionately targeted by BEC and impersonation scams. Their first 90 days are the riskiest. Here is how to build security into onboarding from day one.