🔗 FieldNotes – The hidden HR cost of security awareness training
Reminders, overdue notices and report preparation all take time. Here’s a view on HR workload that belongs in your next awareness renewal.
Cybersecurity Insights Field Notes
Field Notes
Cybersecurity Insights Field Notes
🔗 Field Notes – The bait is made of what you love
A Montrachet at an impossible price lands in the inbox of someone who has spent years posting about white Burgundy. Wine phishing scams are not spray and pray. They are built from leaked customer data and public passion, and the wine trade taught attackers everything they know about scarcity and urgency.
Cybersecurity Insights Field Notes
🔗 Field Notes – Comfort is the attack surface on both sides of the firewall
The 2026 SANS survey lands on a reassuring finding: a trained, skeptical human is still the best defense against AI-enabled attacks. Sit with the rest of the numbers and a harder pattern shows up. Skepticism runs on time and discomfort, and an AI-shaped attack is built to remove both, on both sides of the firewall.
Cybersecurity Insights Field Notes
Field Notes — The consent your employees never gave was set for them
Excerpt: For two days in July, any Instagram user could pull another person’s public posts into an AI-generated image by @-mentioning them, with the setting enabled for everyone by default. Meta withdrew the option after backlash. The interface disappeared. The assumption underneath it, that a person’s public content is reputation exposure rather than attack material, did not.
Cybersecurity Insights Field Notes
Field Notes – What bank warnings about spear phishing actually miss
Banks are warning employees about spear phishing again. The checklists are familiar: verify the sender, use a second channel, follow approval processes. Good hygiene. But the warning itself encodes an assumption that is quietly wrong, that the threat is still mostly about email, and mostly about obvious manipulation. It is not.
Cybersecurity Insights Field Notes
Field Notes – We mistook fluency for judgment, and the gap is now generational (aka the security skills gap is now YOUR problem)
A free malware-as-a-service platform built and traded by teenagers has infected over 116,000 machines through Minecraft mods, with a suggestions page where users vote on adding ransomware. The reflex is to blame the kids. The harder observation is that we mistook a generation’s fluency with technology for judgment about it, and the people who actually hold that judgment are retiring.
Cybersecurity Insights Field Notes
Field Notes – Healthcare biometric breach: the data you cannot reissue
NYC Health + Hospitals disclosed a months-long breach exposing biometric, medical, and financial data for 1.8 million people through a third-party vendor. Two-thirds of the dataset can be rotated. The rest cannot. The remediation playbook the industry inherited from the credit-card era does not bend to fit data that is permanent by nature.
