You don’t only have to target biological or cognitive processes to be a successful social engineer…

Phishing simulations will deliver failure to someone. Some thoughts on where the response to that failure could go… 

Would I socially engineer a social engineer again? No. It wasn’t fair, and it was just showing off. But it does show how much OSINT a ‘crafted’ attack needs… (Not much)

Processes + UX + Social Engineering = Cyber Social Engineering…. Should it be a ‘thing?’ I’m not sure…

Being ‘in the zone’ is great for work, but it’s not great for making security decisions…

This explores one way of reimagining employee phishing simulations. Let employees phish each other…