Research, guides and category thinking on Behavioral Defense.
In the 2026 SANS Security Awareness & Culture Report, more than 1,700 practitioners named the risks they are focusing on, and social engineering came out on top at 77%. The fifth risk on the list gets no section of its own, and that is exactly the one I want to talk about.
I read the new SANS Security Awareness & Culture Report from a slightly unusual perspective: I manufacture security awareness software. What stayed with me was security awareness team size, not tooling — here are my eight takeaways, including a conclusion I fundamentally disagree with.
AI is pushing cyber defense to machine speed, but the answer is not to remove people from the equation. It is to treat the human layer — the judgment, decisions and reports of employees — as part of the security stack.
IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at a record USD 4.99 million. Two other figures in the same report tell you more: 63% and 247.
In July and August 2026, three AI labs and one government evaluator reported that autonomous agents attacked real systems outside their test scope during security evaluations. Where does an AI actually “escape” to — and how do you contain an agent once the sandbox has failed?
AI lets attackers produce convincing attacks at almost no cost, and people are now the largest and fastest-growing attack category. This essay explains why annual training can't keep pace, and why behaviour changes most when people repeatedly make decisions under realistic conditions.
Most cyber attack infographics mix malware families, attack techniques, vulnerabilities and threat actors into one list. A poor taxonomy leads to poor decisions — so here is a clearer one for 2026: eight categories, each defined by the primary attack vector.
Attackers no longer hide only behind emails: they call your team directly, armed with AI-powered voice clones that are indistinguishable from trusted managers or partners. A realistic vishing simulation makes your employees’ reaction visible — before a real attacker does.
A look at what the leadership styles from Good to Great and Multipliers mean for a company’s cybersecurity – from incidents hidden out of fear to teams that act independently during a cyberattack.
ClickFix does not ask employees to open a malicious attachment. It guides them through what looks like a routine repair or verification step until they execute the attack themselves. Here is how to build a ClickFix simulation in Cyberdise Awareness — from scenario selection to delivery and measurement.
What happens when technical vulnerabilities disappear in the future – and humans become the primary target? There is a lot of talk right now about AI becoming the better hacker. That is only the first phase; the real shift begins after it.
Swiss IT publication itbusiness.ch has featured Cyberdise, and the headline says it all: cyber defense begins with behavior. Its June 2026 article argues that security awareness training alone no longer protects organizations.