Security Awareness Training Blog

Keeping You Informed. Keeping You Aware.
Stay on top of the latest in security including social engineering, ransomware and phishing attacks.

Don’t Put Real Answers Into Your Password Reset Questions

This recent article on how a hacker used genealogy websites to help better guess victims' password reset answers made it a great time to share a suggestion: Don’t answer password reset ...
Continue Reading

Educate Your Users About Malicious SEO Poisoning Attacks

Since the beginning of computers, social engineering has been the number one way that computers and networks have been compromised. Social engineering is involved in 70% to 90% of all ...
Continue Reading

[Cybersecurity Awareness Month] Prepare for All Manner of Cyber Threats Like the Heroes of ‘The Inside Man’

Mark Shepherd, the Inside Man, is on a mission.
Continue Reading

[On-Demand Webinar] On How To Avoid Hiring Nation-State Fake Employees

In July 2024, KnowBe4 revealed that we had unknowingly hired a North Korean who was pretending to be someone else. We locked down the laptop that was sent to the fake employee within 25 ...
Continue Reading

More Carrots and Fewer Sticks

This blog was co-written by Perry Carpenter and Roger A. Grimes. As I sit in the 2024 Seattle Convene conference this week and listen to speaker after speaker talk about their successful ...
Continue Reading

Is Disabling Clickable URL Links Enough?

Recently, we had a customer reach out to ask if disabling clickable uniform resource locator (URL) links in emails was enough protection by itself to potentially not need employee ...
Continue Reading

Roger’s Hacking Stories

In this post, I'll share two fascinating hacking stories I've experienced: one involving a sophisticated scam that targeted a major U.S. Fortune 500 conglomerate, and another detailing ...
Continue Reading

CISA’s Red Team Exercise Shows Value of Phishing, but Misses the Best Recommendation

Phishing is used to completely compromise the victim’s environment after other repeated methods failed.
Continue Reading

Chile Leads Latin America With New Cybersecurity Governance

Chile took a major step toward a more resilient cyber landscape for its citizens and the Latin American region on Tuesday, March 26, 2024, when Chile’s president of the Republic, Gabriel ...
Continue Reading

Ransomware Attacks on Healthcare Is Costing Lives

Ransomware is more prolific and expensive than ever. Depending on the source you read, the average or median ransomware payment was at least several hundred thousand dollars to well over ...
Continue Reading

Simulated Phishing Tests Matter

If you had to choose between regular cybersecurity training and simulated phishing testing, the data shows you should choose simulated phishing tests.
Continue Reading

Fighting Phishing: Everything You Can Do to Fight Social Engineering and Phishing

I have created a comprehensive webinar, based on my recent book, “Fighting Phishing: Everything You Can Do to Fight Social Engineering and Phishing”. It contains everything that KnowBe4 ...
Continue Reading

Social Engineering Scams Can Come in the Mail, Too

Social engineering scams can come through any communications channel (e.g., email, web, social media, SMS, phone call, etc.). They can even come in the mail as the Nextdoor warning below ...
Continue Reading

The Hard Evidence That Phishing Training and Testing Really Works Great

Security awareness training (SAT) and simulated phishing works to significantly reduce cybersecurity risk. We have the data, customer testimonials and government recommendations to prove ...
Continue Reading

KnowBe4 Free Tools Now Available On CISA’s Website

We are big fans of the U.S. Cybersecurity Infrastructure Security Agency (CISA), whose informal slogan of “An organization so committed to security that it’s in our name twice” is a ...
Continue Reading

Black Basta Ransomware Uses Phishing Flood to Compromise Orgs

Rapid7 reports an interesting social engineering scheme that easily bypasses content filtering defenses and creatively uses a fake help desk to supposedly “help” users put down the attack.
Continue Reading

Google’s Multi-Party Approval Process Is Great, but Not Unphishable

Like most observers, I celebrated Google’s recent announcement on April 9th about new multi-party approvals for a handful or so of common actions accomplished by super admins in Google ...
Continue Reading

Is RogerLovesTaco$24 a Strong Password?

Is "RogerLovesTaco$24" a strong password? No! Everyone has a ton of passwords. They should be strong and unique for every site and service you use. Everyone knows this.
Continue Reading

The Art of Huh?

One of the best things you can teach yourself, your family, and your organization is how to recognize the common signs of phishing and how to mitigate and appropriately report it.
Continue Reading

Next Week is World Password Day!

May 2nd is World Password Day. Despite the computer industry telling us for decades that our passwords will soon be gone, we now have more than ever!
Continue Reading

Get the latest about social engineering

Subscribe to CyberheistNews