Back in April I wrote that CISOs should start treating frontier AI models as an AI-native insider threat. The last few weeks were a good reminder that the old-fashioned kind hasn't gone anywhere... one allegedly showed up with a microphone wrapped in toilet paper. Concern #1: The recon was sitting in his own tools According … Continue reading The insider threat is in your conference room
Category: Security Awareness
They clicked on a championship ring. Now what?
Earlier this month I wrote that phishing is an industry and that click rate is a vanity metric. Then the Knicks showed us what a phishing test built around the click looks like. In late September, Madison Square Garden emailed a long list of employees: "(Employee name), this one is on the house. MSG is … Continue reading They clicked on a championship ring. Now what?
Phishing is an industry… Is your phishing program up to the challenge?
Back in 2023 I gave a talk called Your Phishing Program is a Waste of Time and Money (or rant, depending on your angle). This week Microsoft published what the other side's program looks like. Spoiler: theirs has a storefront, a sub-reseller tier, and over 2,300 templates. They built a business Microsoft's write-up describes YAM … Continue reading Phishing is an industry… Is your phishing program up to the challenge?
