Today's digital threats are complex. There’s so many more tools at a bad actor’s disposal now than even 10 years ago. While pure technical exploitation of an organization does happen, some form of social engineering typically kicks off the attack. Whether it’s a fake invoice, a text message, or QR code, these are some ways they get past your organization’s defenses by manipulating employees and other parties.

It’s not just social engineering to gain access to a system’s data, it’s used to scam you and your team out of money. We’ve had client’s tell us stories where someone impersonated leadership that resulted in an employee getting scammed.

Disinformation also has the power to create turmoil in your business whether it’s through the use of cheap fakes or deepfakes. Disinformation can impact your industry also. You now have to contend with threat actors using A.I. or simple clever uses of text, audio, and video to deceive you.

This is why cybersecurity awareness and OSINT (Open Source Intelligence) training is no longer optional. It’s essential.

We understand that your organization is probably leveraging cybersecurity awareness training vendors that offer testing and phishing simulations. Depending on some laws, or how it’s spelled out in a cybersecurity framework, the minimal frequency of training is once a year for compliance purposes.

You need more touch points than that because threats evolve over time. The trainings we’ve taken ourselves don’t use real world examples. Nor do they provide tools and techniques that help empower someone to safely dig a little to figure out if what they’re looking at is legitimate. Nor have we seen, or been a part of, a training that puts OSINT skills in the hands of people like HR to suss out fake resumes.

This is where custom training is important.