Security awareness tips, industry news, and product updates.
September brings the year's biggest wave of new starters - and attackers time their CEO impersonation campaigns to match. Why the first 90 days are the most phishable window of any tenure, and how to protect the whole incoming cohort.
NYDFS has told regulated financial entities, in writing, to train staff against help-desk vishing attacks. Combined with the fully effective Part 500 amendment and a record enforcement run, targeted social-engineering training is now a supervisory expectation in New York.
New 2026 survey data shows one in four Americans received an AI deepfake voice call in the past year - and nearly as many doubt they could spot one. The defense is a policy, not an ear.
Detailed out-of-office auto-replies hand attackers absence dates, deputy contacts, and reporting lines - exactly when SOC staffing is thinnest. How to write OOO messages that say less, and why August deserves its own simulation.
A vishing crew is calling employees as fake Microsoft IT staff and walking them through a bogus Entra passkey enrollment - then registering the attacker's own passkey for persistent access. The weak point is the enrollment moment, not the passkey.
Microsoft is warning of a surge in ACR Stealer infections across its enterprise customers, driven by the ClickFix lure that tricks employees into pasting a malicious command themselves. Here is how the attack works - and why the fix is as much about training as it is about tooling.
North Korean operatives are using deepfakes and synthetic identities to get hired at Western firms. Unit 42 built a convincing fake candidate in about 70 minutes. Here is how to vet remote hires.
PCI DSS v4.0 raised the bar for security awareness, naming phishing and social engineering explicitly. Here is what the standard now requires if you handle card data.
Thread hijacking lets attackers reply inside a real email conversation, with a familiar subject, history, and trusted sender. It defeats the 'unknown sender' instinct. Here is how to spot it.
Attackers are phishing payroll portal logins and impersonating staff to reroute direct-deposit paychecks into accounts they control. The FBI has warned about it for years - here's how HR can stop it.
Phishing has moved out of the inbox and into Microsoft Teams, Slack, and calendar invites — platforms employees trust by default. Here is how the attacks work and how to extend your defenses to cover them.
"Are you available? I need a quick favor." It's the opening line of a gift card scam impersonating your CEO - low-tech, high-volume, and aimed at new and junior staff. Here's the pattern and the one rule that stops it.