“Why Would Anyone Target Me?” When we hear about cybercrime, we often hear about attacks against large corporations, hospitals, banks, government agencies, and wealthy individuals. That can create an understandable assumption: Why would a cybercriminal be interested in me? Maybe you’re a server at a restaurant, a mechanic, a teacher, Read more
Organizations that operate in regulated industries spend considerable time preparing for audits and demonstrating compliance with standards such as HIPAA, PCI DSS, GLBA, SOC 2, ISO 27001, and others. Compliance is important. It establishes a common set of security expectations and helps organizations implement foundational safeguards. However, there is a Read more
When organizations think about cybersecurity, they often focus on protecting the systems and applications they use every day. Firewalls are monitored, endpoint protection is deployed, and users receive security awareness training. While these efforts are important, many security incidents originate from a different source altogether: assets that have been forgotten. Read more
When people think about cyberattacks, they often focus on the moment an attacker first gains access to an account or system. In reality, that initial compromise is usually just the beginning. Modern attacks rarely succeed because of a single event. Instead, attackers often move carefully and deliberately through an environment Read more
When organizations experience a security incident, it is easy to assume that the cause was a single major failure—a sophisticated attack, a missed control, or a breakdown in technology. In reality, most incidents are not the result of one large mistake. They are the result of multiple small gaps that, Read more
Phishing attacks continue to be one of the most common and effective methods used by attackers to gain unauthorized access to systems and information. While many people are familiar with the concept of phishing, modern attacks have evolved far beyond the poorly written emails that once made them easy to Read more
Despite years of security awareness training, new technologies, and stronger regulations, many organizations continue to experience the same types of security incidents. Phishing emails are clicked, sensitive information is sent to the wrong recipient, accounts remain over-privileged, and warning signs are missed until a small issue becomes a major problem. Read more
The Dangerous Comfort of “Being Compliant” Many organizations invest enormous time and energy trying to become compliant with regulations and frameworks such as HIPAA, SOC 2, PCI DSS, NIST, or ISO 27001. Policies are written, controls are documented, and audits are passed. At the end of this process, there is Read more
Why December Is a High-Risk Month December is one of the busiest—and most distracted—months of the year. Year-end deadlines, holidays, reduced staffing, and routine disruptions combine to create the perfect conditions for human error. While cyber threats exist year-round, many security incidents in December happen not because of advanced attacks, Read more
The Convenience—and the Risk—of the Connected Home Smart home devices have made everyday life easier. From voice assistants and connected thermostats to video doorbells and smart TVs, our homes are more connected than ever. But every device connected to the internet is also a potential entry point for hackers. Without Read more