---
title: It only takes three seconds...
description: It only takes three seconds...
---

[KnowBe4 Blog ](https://blog.knowbe4.com)

# [It only takes three seconds...](https://blog.knowbe4.com/it-only-takes-three-seconds)

 Written by [Stu Sjouwerman](https://blog.knowbe4.com/author/stu-sjouwerman) | May 31, 2019 3:44:23 PM

**“Statistics suggest the average human being falls for a social engineering attack about four times — with training — before they become ‘inoculated’ against that type of attack,”** “**Helpful people are a real target,” said David Trepp, IT assurance partner at BPM, a Top 100 Firm in California that also provides pen testing and other security services.**

“For most of your readers, phishing is probably the No. 1 threat,” said David Ross, principal and cybersecurity practice leader at Top 100 Firm Baker Tilly. “There’s been a huge uptick in the last few months in spear-[phishing](https://www.knowbe4.com/phishing) attempts, which are very specifically targeted to an individual. Prevention is a twofold approach: On the technical side, you implement systems to filter and catch as many of these emails [as you can] so they don’t get to the end recipient; the other is personnel training.”

Helpful staff will more readily respond to a stranger who appeals to their willingness to be of service, Trepp explained. For instance, he may pose as an IT person who just needs to take a “quick look” at an accountant’s laptop to “get his boss off his back” and get a fix done quickly.

“All we need is about three seconds with an unblocked, unattended computer, or an employee willing to believe we’re tech support, or a live network jack somewhere where nothing is plugged into — and we’re in,” Trepp explained.

It can seem an insurmountable task to face down cybercriminals and come out on top. Sometimes it feels like a breach is inevitable, and it’s only a question of when. But professional services firms are growing a network of advisors, software and resources to build out cybersecurity and strengthen their security posture. The first step is to take cyber seriously, because all it takes to wipe away a lifetime of client goodwill and data is three seconds. Full [story at AccountingToday](https://www.accountingtoday.com/news/a-cyber-attack-only-takes-three-seconds)

## Find out how affordable new-school security awareness training is for your organization. Get a quote now.

 

 

[View full post](https://blog.knowbe4.com/it-only-takes-three-seconds)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Stu Sjouwerman"
  },
  "dateModified" : "2019-05-31T15:59:24.689Z",
  "datePublished" : "2019-05-31T15:44:23Z",
  "headline" : "It only takes three seconds...",
  "image" : {
    "@type" : "ImageObject",
    "height" : 309,
    "url" : "https://www.knowbe4.com/hubfs/worried-but-not-enough.jpg",
    "width" : 475
  },
  "mainEntityOfPage" : "https://blog.knowbe4.com/it-only-takes-three-seconds",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "KnowBe4 Blog"
  }
}
```