Phishing Attack Awareness Training

🚨 𝗡𝗲𝘄 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗧𝗲𝗰𝗵𝗻𝗶𝗾𝘂𝗲 𝗔𝗹𝗲𝗿𝘁 A sneaky new attack method is making waves — exploiting 𝗲𝗺𝗮𝗶𝗹 𝘀𝘆𝘀𝘁𝗲𝗺𝘀 by "𝗮𝘁𝗼𝗺𝗶𝘇𝗶𝗻𝗴" 𝗺𝗲𝘀𝘀𝗮𝗴𝗲𝘀 to bypass 𝘁𝗿𝗮𝗱𝗶𝘁𝗶𝗼𝗻𝗮𝗹 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗰𝗵𝗲𝗰𝗸𝘀! 🔍 𝗛𝗼𝘄 𝗜𝘁 𝗪𝗼𝗿𝗸𝘀 : • Attackers split a single 𝗲𝗺𝗮𝗶𝗹 into multiple 𝗳𝗿𝗮𝗴𝗺𝗲𝗻𝘁𝘀 ("𝗮𝘁𝗼𝗺𝘀") before it reaches the inbox. • Each 𝗮𝘁𝗼𝗺 looks harmless alone — no full malicious payload is visible at once. • When the 𝗳𝗿𝗮𝗴𝗺𝗲𝗻𝘁𝘀 𝗮𝗿𝗲 𝗿𝗲𝗮𝘀𝘀𝗲𝗺𝗯𝗹𝗲𝗱 by the 𝗲𝗺𝗮𝗶𝗹 𝗰𝗹𝗶𝗲𝗻𝘁, the full phishing or malicious email is revealed. • This bypasses 𝗦𝗣𝗙, 𝗗𝗞𝗜𝗠, and 𝗗𝗠𝗔𝗥𝗖 𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀, making the email appear 𝗹𝗲𝗴𝗶𝘁𝗶𝗺𝗮𝘁𝗲. 🎯 𝗪𝗵𝗼’𝘀 𝗕𝗲𝗶𝗻𝗴 𝗧𝗮𝗿𝗴𝗲𝘁𝗲𝗱? • Enterprises relying on 𝗲𝗺𝗮𝗶𝗹 𝗴𝗮𝘁𝗲𝘄𝗮𝘆𝘀 and 𝘀𝘁𝗮𝗻𝗱𝗮𝗿𝗱 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗰𝗵𝗲𝗰𝗸𝘀. • Organizations with 𝘄𝗲𝗮𝗸 𝗲𝗺𝗮𝗶𝗹 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗽𝗼𝗹𝗶𝗰𝗶𝗲𝘀. 🛡️ 𝗛𝗼𝘄 𝘁𝗼 𝗦𝘁𝗮𝘆 𝗦𝗮𝗳𝗲 : • Apply 𝘀𝘁𝗿𝗶𝗰𝘁 𝗶𝗻𝗯𝗼𝘂𝗻𝗱 𝗲𝗺𝗮𝗶𝗹 𝗽𝗼𝗹𝗶𝗰𝗶𝗲𝘀 — 𝗲𝘀𝗽𝗲𝗰𝗶𝗮𝗹𝗹𝘆 𝗳𝗼𝗿 𝗳𝗿𝗮𝗴𝗺𝗲𝗻𝘁𝗲𝗱 𝗲𝗺𝗮𝗶𝗹𝘀. • Monitor 𝗲𝗺𝗮𝗶𝗹 𝗯𝗲𝗵𝗮𝘃𝗶𝗼𝗿, not just static properties like 𝗵𝗲𝗮𝗱𝗲𝗿𝘀. • Educate teams about spotting suspicious 𝗳𝗿𝗮𝗴𝗺𝗲𝗻𝘁𝗲𝗱 𝗰𝗼𝗺𝗺𝘂𝗻𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀. • Strengthen 𝗲𝗺𝗮𝗶𝗹 𝘃𝗮𝗹𝗶𝗱𝗮𝘁𝗶𝗼𝗻 and 𝗮𝗻𝗼𝗺𝗮𝗹𝘆 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝘁𝗼𝗼𝗹𝘀. ⚡ This isn’t just bypassing a filter — it’s a whole new way to weaponize the very structure of email itself. - #CyberSecurity #Phishing #EmailSecurity #ThreatIntel #InfoSec #AtomizedAttack #SPF #DMARC

EMERGING THREAT VECTOR: PROMPT INJECTION IN PHISHING CAMPAIGNS AGAINST AI DEFENSES ℹ️ In a newly uncovered phishing campaign, attackers have evolved beyond merely targeting human recipients; the email also includes hidden AI-oriented prompt manipulation to evade automated defenses. On the surface, the email mimics a standard “Login Expiry Notice,” warning the recipient that their password will expire and urging them to update their credentials. This reflects classic social engineering tactics, based on the use of urgency and impersonation of Gmail-like branding. ℹ️ However, what sets this campaign apart is the inclusion of a cryptic block of text embedded in the plain-text MIME part, written in the style of a user prompt for AI models like ChatGPT or Grok. It instructs the reader (or AI) to engage in deep reasoning, generate multiple perspectives, and refine responses before output. This is not meant for human users; it is a clever form of prompt injection, designed to confuse AI-based triage or classification systems into overthinking the content instead of flagging it as phishing ℹ️ Prompt injection is a form of adversarial attack where malicious actors manipulate the instructions given to an AI model. Instead of delivering a normal query, the attacker embeds hidden or deceptive instructions inside prompts, documents, emails, or web content. The goal is to override the AI’s intended behavior and force it to execute the attack goal. ℹ️ Prompt injection can be direct (where the attacker crafts the prompt themselves) or indirect (where the malicious content is hidden in data the AI consumes, such as an email body, website text, or PDF). Indirect injections are particularly dangerous because they target automated workflows where humans may not notice the hidden instructions. Reference: 🔗 https://lnkd.in/dDgBHJ5W #threathunting #threatdetection #threatanalysis #threatintelligence #cyberthreatintelligence #cyberintelligence #cybersecurity #cyberprotection #cyberdefense

“Stop clicking on links” 🚫 If this is your advice to people during cyber awareness month, please stop! 🚫 If you’re also maintaining a ‘repeat offenders’ list, please kindly stop that too. It’s counterintuitive and doesn’t work. You operate in a digital world. The majority of tech and tools that you provide to employees require them to click on links and apps - documents, collaboration tools, payslips etc Telling people to click sometimes, and not others is confusing and you’re shifting the onus onto the individual to know what is legitimate, and what isn’t. Even expecting them to open a new tab, or type in a URL directly into a browser instead of just clicking what is in front of them. Lets face it, most people are not going to add extra steps to their routine, unless it’s obvious that the message is a bit strange, or it impacts them directly. Threat actors learn to counteract how we train people, they obfuscate what they’re doing, so most people have no idea it’s a fake domain, or a malicious macro is running on a spreadsheet Yet you want to blame them, for not knowing about the constant changes in tactics and techniques? A few things you can do instead… ✅ The security tools you deploy should act as a safetynet, that verifies the legitimacy of each link and attachment, by scanning and launching in a sand box environment to check whether malicious to provide added assurance to the person. ✅ Instead of giving people a long list of things to do like checking headers, hovering over links and various things that they’re not going to do, help them to understand the intent behind the message. Even if something looks and sounds genuine, what are you being asked to do as a result of this action? ✅ Empowering people to say NO to unrealistic demands, timelines and requests that are outside the norm of their role, because these are also the type of things that a threat actor will do! ✅ When people are suspicious and report it as potential phishing, please actually reply to them! Ask them why, let them know whether they were right to be suspicious, and what you did as a result. ❤️ Instead of focusing on what you consider bad behaviour, how about you champion all those that are demonstrating positive behaviour instead?

🛠️ “If it ain’t broke, don’t fix it.” It’s a saying that works for a leaky tap or an old lawnmower…but not for cybersecurity. Imagine walking into this server room and being able to find a needle in a haystack, or a patch cable in forest. Sure, it might be easier to run a new cable, but when you continually ignore the root cause, this is what can happen. The same can be said about unpatched software, legacy servers, unsupported firewalls, they might look fine on the surface, but under the hood they’re one zero-day away from disaster. The truth is: 🔹 Cybercriminals love “if it ain’t broke” thinking. 🔹 End-of-life tech is their easiest way in. 🔹 And the cost of doing nothing? Often far more than the cost of upgrading. Let's addressed common myths with insights on ways to strengthen your cyber defences.✅ 1. Basic #cybersecurity training isn't enough: The focus should be on real life examples and higher level education to raise awareness 2. Zero-trust solutions are NOT all the same: Beware of vendors and their false promises (get references for your use cases). 3. Cloud providers do not secure by default: Adding layers of security is a MUST in the cloud. 4. Cyber security is everyone's responsibility: Like driving a bus, you need to bring everyone on the journey, it's not just IT. 5. More tools aren't always better: Streamlining your tech stack can reduce complexity. 6. Strong passwords alone aren't enough: Utilise Multifactor Authentication (MFA) where possible. 7. SMS-based MFA is vulnerable: Look for app or biometric based solutions. 8. Advanced tools can cause gaps: The human factor requires training and the implementation of processes. 9. Logins can still be compromised: Dynamic access control limits the blast radius. 10. Physical and virtual cybersecurity are just as important: Secure both the data and asset. 11. It's not "if", it's "when": Being proactive mitigates risk but does not eliminate them, have a response plan. 12. Quantum computers aren't a universal decryption tool: Be prepared though. 13. Secure you SaaS apps: Expecting the provider to secure your services leaves you vulnerable, include these in your security profile. 14. Humans make mistakes: By train your staff, you can apply them as your human firewall to secure your organisation. 15. Stay alert and ever present: Keep yourself updated on evolving threats. 16. Assume you will be breached: Test your detection and response capabilities. 17. Obscurity doesn't equal security: Robust measures are key, regardless of size. 18. Don't rely on vendors for compliance: Take responsibility for your data. 19. Cybersecurity is an investment, not a burden: It protects your reputation and finances. This #Cybersecurity Awareness Month, challenge the old mindset. ✅ Audit your legacy tech. ✅ Patch and replace what’s past its prime. ✅ Segment, monitor, and protect what can’t yet be retired. Need help? Reach out to the team at ASE Tech #ShitHappens #ThinkBeforeYouCluck

Yesterday my daughter made an observation that’s relevant to all mid-market CISOs. While speaking to her on voice call, my father-in-law struggled to switch the WhatsApp call to video to show their dog’s antics. He asked my mother-in-law to help. While on the call, my mother-in-law needed to transfer money via UPI to someone. So they had to cut the call - because my father-in-law needed to step in! My daughter came to me with this question: Two people. Same house. Same everyday things. Yet their skill levels are so different. Now, imagine this inside a company with hundreds or thousands of employees. - Some struggle to identify phishing emails - Some don’t understand the risk of weak passwords - Some click on malicious links without a second thought - Some approve payment requests based on text messages - Some download & install unauthorized software - Some share sensitive information over email without realizing - Some upload company secrets into ChatGPT for projects Yet, many CISOs run just 𝙤𝙣𝙚 𝙤𝙧 𝙩𝙬𝙤 cyber awareness simulations per year & think it’s enough. It’s not. Cyber awareness needs to be continuous, personalized & measurable. A strong cyber awareness program should: 𝟭) 𝗧𝗲𝘀𝘁 𝗲𝗺𝗽𝗹𝗼𝘆𝗲𝗲𝘀 𝘄𝗶𝘁𝗵 𝗿𝗲𝗮𝗹-𝘄𝗼𝗿𝗹𝗱 𝗮𝘁𝘁𝗮𝗰𝗸 𝘀𝗰𝗲𝗻𝗮𝗿𝗶𝗼𝘀 Phishing, smishing, vishing, and deepfake attacks that mimic what attackers actually do. 𝟮) 𝗔𝗱𝗮𝗽𝘁 𝘁𝗿𝗮𝗶𝗻𝗶𝗻𝗴 𝗯𝗮𝘀𝗲𝗱 𝗼𝗻 𝗶𝗻𝗱𝗶𝘃𝗶𝗱𝘂𝗮𝗹 𝘀𝗸𝗶𝗹𝗹 𝗹𝗲𝘃𝗲𝗹𝘀 A finance executive needs different training than a new intern. 𝟯) 𝗢𝗳𝗳𝗲𝗿 𝗲𝗻𝗴𝗮𝗴𝗶𝗻𝗴, 𝗶𝗻𝘁𝗲𝗿𝗮𝗰𝘁𝗶𝘃𝗲 𝘁𝗿𝗮𝗶𝗻𝗶𝗻𝗴 Gamification, role-based training, and bite-sized learning improve retention. 𝟰) 𝗧𝗿𝗮𝗰𝗸 𝗶𝗺𝗽𝗿𝗼𝘃𝗲𝗺𝗲𝗻𝘁𝘀 & 𝗿𝗶𝘀𝗸𝘆 𝗯𝗲𝗵𝗮𝘃𝗶𝗼𝗿 Identify employees who need extra training instead of treating everyone the same. 𝟱) 𝗥𝘂𝗻 𝗰𝗼𝗻𝘁𝗶𝗻𝘂𝗼𝘂𝘀 𝘀𝗶𝗺𝘂𝗹𝗮𝘁𝗶𝗼𝗻𝘀, 𝗻𝗼𝘁 𝗼𝗻𝗲-𝘁𝗶𝗺𝗲 𝗲𝘃𝗲𝗻𝘁𝘀 Cyber threats evolve daily; training should too. 𝟲) 𝗚𝗶𝘃𝗲 𝘁𝗵𝗲 𝗰𝘆𝗯𝗲𝗿 𝗮𝘄𝗮𝗿𝗲𝗻𝗲𝘀𝘀 𝗽𝗼𝘀𝘁𝘂𝗿𝗲 𝗮𝘁 𝘁𝗵𝗲 𝗰𝗹𝗶𝗰𝗸 𝗼𝗳 𝗮 𝗯𝘂𝘁𝘁𝗼𝗻 Department-wise reports of people & the potential learning gaps Awareness is not running a simulation & calling it a day. It's the actions & the next steps: - for improvement - knowing the awareness posture of everyone - for building a culture where employees become security assets If you’re a CISO evaluating solutions that train employees further based on their actual responses, DM me. My team works with a platform designed to make cyber awareness practical, engaging & effective. -- Hi, I’m Rajeev Mamidanna. I help mid-market CISOs strengthen their Cyber Immunity.

Think your inbox is secure? Think again. Here’s a quick breakdown of a sophisticated phishing attempt that made me question my own defenses. It's been a while since a well-crafted phishing email landed straight in my inbox. Today, I’m sharing a quick breakdown of this sophisticated attempt and the tactics used. 👇 🎣 The Phishing Email 1️⃣ The Sender This email came from a compromised mailbox belonging to a reputable real estate agency in France — this gives it a good domain reputation which likely explains why it bypassed my filters despite everything being sent in "bcc". (Note to self: time to revisit my email gateway settings, being in "bcc:" without "to:" is an obvious flag) 2️⃣ The Pretext & Alignment It posed as an RFP with a deadline on August 30th. As the CEO still handling key sales operations at Arsen Cybersecurity, it made sense for this to land directly in my inbox, I'm the correct target. The urgency factor is a classic psychological ploy in phishing (and effective email marketing), aiming to prompt immediate action before rational thought kicks in. 🌐 The Phishing Kit 1️⃣ Compromised Account & Customized Attack The attacker didn’t stop at a compromised email account—they used it to conduct a credential harvesting attack. They registered a free WordPress site with SSL, hosted on a customized subdomain mimicking the impersonated brand (https://BRAND[.]wordpress[.]com). If you can't properly read an URL, this will build trust. Using WordPress[.]com also improves the chance of delivery, leveraging their authority and domain reputation to pass filters. 2️⃣ Protection with reCAPTCHA The big CTA button on the WordPress site (see screenshot) led to a lander guarded by reCAPTCHA—clearly to deter bots and inspection tools. It was hosted on an old domain with recently updated WHOIS information, once again appearing more legitimate than it is. 3️⃣ Realistic Login Page After the CAPTCHA test, the landing page featured a convincing login page. A fun (yet alarming) detail: I tested it with a bogus email address, and it actually verified its legitimacy against Google accounts! The password field was also checked live—suggesting a reverse proxy setup aimed at capturing session cookies and bypassing TOTP MFA. ✅ Key Takeaway While we’re all on alert for advanced threats like deepfakes and AI-driven attacks, the old-school credential harvesting phishing email remains a popular and very real threat. 🔒 Stay vigilant, stay safe! For those interested, here’s the IoC / phishing domain used with the kit: orvistelp[.]com Feel free to share your thoughts or similar experiences below. Let’s keep the conversation going! 👉 Cc: Thomas Damonneville Régis Senet Christophe Dary #phishing #cybersecurity

A New Cyber Threat: Russian-Linked Group Exploits Device Code Phishing to Breach Networks In a concerning development, Microsoft has uncovered a sophisticated phishing campaign leveraging “device code phishing” to infiltrate target networks. This attack, attributed to a likely Russian state-sponsored group tracked as Storm-2372, has been actively targeting sectors across Europe, North America, Africa, and the Middle East since August 2024. Device code phishing exploits the device code authentication flow, typically used for signing into devices that lack local input interfaces, such as digital signage or shared devices. By manipulating this process, attackers can intercept authentication tokens and gain unauthorized access to target accounts. The attack begins with social engineering tactics. Threat actors use third-party messaging apps like WhatsApp, Signal, and Microsoft Teams to send fake meeting invitations. Victims, believing they are joining a legitimate meeting, are prompted to authenticate via a device code. Once the victim enters the code, the attacker receives a valid access token, which may grant broader access to other services depending on the permissions. Given the stealth and effectiveness of this attack, organizations must take proactive measures to defend against device code phishing: Disable Device Code Authentication – If not needed, organizations should disable this authentication flow within their identity provider settings. Implement Conditional Access Policies – Restricting sign-ins based on device compliance and geographic location can reduce risk. Monitor for Anomalous Access Requests – Unusual device registrations and sign-ins should trigger immediate investigation. Enforce Multi-Factor Authentication (MFA) – Strengthen identity verification by enforcing MFA with phishing-resistant methods like FIDO2 or certificate-based authentication. User Awareness Training – Educate employees on the risks of phishing, particularly those using messaging apps for authentication requests. At AdvisorDefense, we specialize in helping Registered Investment Advisors (RIAs) and financial firms fortify their cybersecurity defenses. If you're concerned about your organization’s exposure to these types of attacks, let’s talk about how we can strengthen your defenses against evolving cyber threats. #CyberSecurity #ThreatIntel #Phishing #DeviceCodePhishing #MicrosoftSecurity #AdvisorDefense https://lnkd.in/eVFesxJy

Would you fall for a fake email from Amazon.xyz ? Because 690,502 people just like you did. A new rigorous, empirical study shows how modern phishing attacks work. And it's not what you think. Here's the wild part: Two-thirds of these attacks use brand new web addresses that look ~almost~ real. 📊 The Data: - 39 Months  - 690,502 Phishing Sites Here's The Attacker Playbook: 1. Buy Cheap, Throw Away Fast • Use .top and .xyz domains • Cost pennies to buy • Easy to dump when caught 2. Copy Famous Names • Amazon becomes Amaz0n.xyz • PayPal becomes PayPal-secure.top • Microsoft becomes Micros0ft.xyz 3. Play Digital Hide & Seek • Switch servers every few days • Change settings constantly • Stay ahead of blockers 🔍 The Numbers Tell the Story: • 66.1% use fresh domains • 64.3% keep changing servers • Takes 11.5 days to shut them down Keep Yourself Safe: 1. Check EVERY Link • Hover before clicking • Look for weird spellings • Question unusual extensions 2. Watch Out For: • .top domains • .xyz domains • Any odd-looking web address 3. Trust Your Instincts • Looks fishy? Probably is • Verify the sender • Check independently 💡 Key Takeaway: Modern phishers aren't using obvious fake emails anymore. They're playing a sophisticated game of digital deception. Stay sharp. Stay safe. ♻️ Share this to help others spot these tricks. 👉 Follow me for more security insights that keep you protected. #Cybersecurity #PhishingAwareness #DigitalSafety #TechSecurity

Phishing isn’t going away—AI alone can’t stop it. As cybercriminals grow more sophisticated, AI-powered defenses are being pushed to their limits. While AI has revolutionized phishing detection, it’s not a magic solution. Here’s the reality: cybercriminals are constantly evolving their tactics, and automated systems can’t catch everything. Here’s why: → Adapting Faster Than AI: Phishers use personalization, obfuscation, and dynamic content to stay one step ahead of AI detection models. → Exploiting Trust: By hosting phishing sites on legitimate platforms or using benign-looking URLs, attackers make it harder for AI to flag malicious intent. → Novel Tactics Go Unnoticed: AI systems trained on historical data often miss brand-new phishing techniques designed to evade detection. So, what’s the solution? ✔️ Continuous Learning: AI systems must be updated frequently with new data to adapt to emerging threats. ✔️ User Education: Humans are the last line of defense. Teaching employees how to spot phishing attempts is critical to stopping attacks. ✔️ Hybrid Models: Combining AI-driven detection with human oversight ensures the context and intuition machines lack. The takeaway? AI is a powerful tool, but it’s not enough. Fighting phishing requires a multi-layered approach, where people and technology work together to stay ahead of the curve. Are we ready to rethink how we defend against phishing? Let’s discuss.

🚨 Phishing Alert: A Deceptive Threat That Exploits Human Trust 🎣 Phishing isn’t just another cyber threat—it’s an advanced social engineering technique designed to manipulate human psychology and exploit security gaps. Threat actors continuously refine their methods, bypassing traditional security controls and leveraging trust-based deception. Are your defenses strong enough? 🔍 Understanding Phishing Variants Phishing isn’t one-size-fits-all. Attackers tailor their strategies to maximize success rates. Some key techniques include: 🔹 Credential Harvesting – Fake login pages mimic legitimate platforms, stealing authentication data. 🔹 Malware-Embedded Emails – Attachments contain trojans, keyloggers, or ransomware payloads. 🔹 Session Hijacking via OAuth Exploits – Phishers manipulate OAuth-based authentication to gain unauthorized access. 🔹 BEC (Business Email Compromise) – Impersonation attacks targeting executives to manipulate fund transfers. 🔹 AI-Driven Spear Phishing – Leveraging AI to craft hyper-personalized phishing attempts that bypass traditional detection. 🚨 TTPs (Tactics, Techniques, and Procedures) of Phishers 🔴 Domain Impersonation & Lookalike Domains – Example: "g00gle.com" instead of "google.com" (homograph attack). 🔴 Exploiting Open Redirects & Shortened URLs – Attackers mask malicious URLs to bypass email security gateways. 🔴 HTML Smuggling – Embedding malicious scripts within HTML attachments to evade security scans. 🔴 Adversary-in-the-Middle (AiTM) Phishing – Bypassing MFA through reverse-proxy-based credential interception. 🔴 QR Code Phishing (Quishing) – Users are tricked into scanning QR codes that lead to phishing sites. 🛡️ Hardening Your Security Posture ✔ Zero Trust Approach – Never implicitly trust any communication, even if it appears legitimate. ✔ Advanced Threat Detection (AI & ML-Based Solutions) – Behavioral analytics can identify phishing anomalies. ✔ Real-Time Threat Intelligence Feeds – Proactive defense against emerging phishing campaigns. ✔ FIDO2 Authentication & Passwordless Security – Eliminating passwords reduces credential theft risks. ✔ Email Security Enhancements – Implement DMARC, SPF, and DKIM to minimize spoofing attempts. ✔ Security Awareness & Phishing Simulations – Continuous training to build a human firewall against deception. 🚀 Final Thought: Phishing is not just an IT problem—it’s a business risk. As attackers refine their methodologies, organizations must stay ahead with proactive security measures, advanced threat intelligence, and a zero-trust mindset. 🔁 Like, share, and comment—how does your organization combat phishing? #Phishing #CyberSecurity #RedTeam #BlueTeam #ZeroTrust #Infosec #EmailSecurity #OnlineScams #ZeroTrust #IncidentResponse #OnlineSafety #CyberThreats #infosec #informationsecurity #networking #networksecurity #infosecurity #cyberattacks #security #ITSecurity #InsiderThreats #TechLeadership #informationtechnology #technicalsupport