Most cyber attack infographics mix malware families, attack techniques, vulnerabilities and threat actors into one list. A poor taxonomy leads to poor decisions — so here is a clearer one for 2026: eight categories, each defined by the primary attack vector.
Microsoft Defender for Office 365 ships with its own phishing simulation and awareness platform. In some areas it is very good. In others, structural limits appear very quickly. This is a deliberately balanced look at both sides.
Microsoft Defender Attack Simulator is included with E5 licenses, and several German and Swiss mid-sized companies have let their awareness vendor contracts expire to rely on it instead. Organizations that genuinely care about attentive, well-sensitized employees are not well served by it.
Attitude and behavior are related, but they are not the same. Confusing them is one of the main reasons why many awareness programs fail to deliver lasting risk reduction.
Like any other project, a cybersecurity awareness program can get off to a very bumpy start when it begins with an inappropriate mindset and management fails to recognize the value of awareness. We examined the mistakes and false expectations documented in a USENIX study and compared them with our own experience.
Despite comprehensive security awareness training, many organizations still have cybersecurity breaches resulting from human error. This article is about the gap between risk attitude (knowing what is risky) and risk behavior (actually acting securely).
Many security awareness providers and solutions cannot cover what their customers require. This article lists their common weaknesses and the practical steps larger organizations can take to address them.
Compliance is a cornerstone of trust, security and resilience, yet telling GDPR, NIS2 and ISO 27001 apart can feel like solving a puzzle. Here is what each framework requires, what non-compliance risks and how the three interconnect.