When a threat actor impersonates a trusted contact inside your organization, the question is not whether your firewall can stop them. It is whether your employees are trained to pause before they comply. That is the lesson inside the ASOS data breach confirmed this week, and it applies to every Canadian organization with more than […]
ASOS Breach: The Behaviour Change Cybersecurity Lesson Read More »
On September 18, 2026, the FBI, Japan’s National Police Agency, Australia’s Australian Cyber Security Centre, and Germany’s federal security agencies issued a joint advisory about a North Korean state-sponsored group called WaterPlum. Between December 2025 and July 2026, the group infected more than 30,000 devices across 100 countries and stole $10.71 million from roughly 7,000
Fake Job Interviews Expose Security Awareness Training Gaps Read More »
A text message arrives on the phone of a Canadian nonprofit’s finance manager, appearing to be from a trusted bank contact with the right account details, asking for a wire transfer before end of day. The manager complies. The message was not from the bank. Across every sector, Canadian organizations are encountering this scenario at
Smishing Prevention in the Age of AI Voice Cloning Read More »
Most ransomware awareness training programs teach employees to recognise malicious attachments, suspicious links, and spoofed sender addresses. That coverage is necessary but no longer sufficient. The ShinyHunters campaign targeting healthcare organisations, reported by HealthSystemCIO on September 10, 2026, reveals the gap: ransomware actors now routinely begin their attack with a phone call, not an email,
What Ransomware Awareness Training Misses About Vishing Read More »
Voice phishing has quietly overtaken email as the preferred entry point for attackers targeting organisations, and no amount of technical filtering closes that gap without genuine behaviour change. According to Google Cloud’s Mandiant M-Trends 2026 report, vishing accounted for 11 per cent of all confirmed initial access methods observed across more than 500,000 hours of
Behaviour Change Cybersecurity: Beating Voice Phishing Read More »
On 21 August 2026, Apollo Global Management disclosed a data breach: between 6 and 10 July, attackers had gained unauthorised access to several of the firm’s cloud platforms and exposed names, dates of birth, home addresses, and Social Security numbers belonging to an unknown number of people. Apollo manages more than one trillion dollars in
Vishing Awareness Lessons from the Apollo Data Breach Read More »
The message from Black Hat USA 2026, which concluded in Las Vegas on August 7, was directed squarely at organizations still running annual click-training programs: the attackers have moved on, and so must you. Researchers documented a threat landscape in which AI tools produce flawless phishing emails at 95 percent lower cost than manual campaigns,
Behaviour Change Cybersecurity: 4 Lessons from Black Hat Read More »
The phone rings at a Canadian IT help desk. The caller identifies themselves as someone from the security team, explains that an account is about to be locked out, and asks the agent to quickly reset the user’s MFA credentials. The call is convincing, the urgency feels real, and the agent has been trained to
Vishing Awareness: Canada’s IT Help Desks Under Attack Read More »
Your employees can spot a suspicious email. Fewer of them are prepared for the phone call that follows: someone claiming to be from IT, asking them to register a new passkey, and in minutes the attacker has their Microsoft 365 credentials. This is the active O-UNC-066 campaign, and it targets sectors that form the backbone
Pink Vishing: Security Awareness for Canadian Organizations Read More »
When a stranger walks into your office, identifies themselves as IT support, and plugs a USB drive into a workstation while your employee watches, every firewall you own is irrelevant. That is not a hypothetical. On May 26, 2026, the FBI issued a FLASH alert about the Silent Ransom Group (SRG), a Russia-linked extortion operation
Your Security Awareness Program Needs an In-Person Clause Read More »
