When it comes to cybersecurity, the first step of security awareness is often overlooked, but it's one of the most critical components of any cybersecurity strategy. In this blog post, we'll discuss what the first step of security awareness is and why it's so important. Spoiler - you have to focus on risk, specifically human risk.

Check out our weekly Security Digest Stream. In this Stream, we use the latest news about the LastPass data breach to engage employees about the importance of securing all devices, including personal devices.

Basic security awareness training is an essential component of any cybersecurity strategy. It involves educating employees on the best practices for keeping sensitive information secure and protecting against cyber-attacks. In this blog post, we'll discuss the basics of security awareness training and why it's important for every organization.

Have you ever heard of the 90/10 rule on cybersecurity? It's a concept that states that 90% of cybersecurity is about implementing the right policies and procedures, while the other 10% is about implementing the right technology. In other words, the vast majority of cybersecurity is about the human factor, the factor that follows approved workflows outlined in policies and procedures, rather than the technology factor.

Security awareness is an essential aspect of cybersecurity. It is about ensuring that people are aware of the potential security risks and how to mitigate them. There are different types of security awareness, and in this blog post, we will discuss the four most common types of security awareness.

Haekka is deeply integrated with Slack to meet employees where they already are. By using Slack's bite-sized format, Haekka delivers digestible content and engages employees with modern tools to increase training completion rates. Slack notifications are used to keep employees on task and engaged, while the platform's focus on security and privacy ensures users' data is protected.

Cybersecurity is more important than ever before, especially with the rise of remote work and the increasing amount of sensitive information being stored online. Add to that the ease of launching cyberattacks with AI and software and it is a perfect storm. To ensure effective cybersecurity, organizations should focus on the six pillars of cybersecurity. In this blog post, we will discuss these six pillars and why they are important.

Security training is a vital part of keeping organizations safe from cyber-attacks. So vital, we built a platform to integrate security training, knowledge, and thinking into the apps and workflows of all employees. Cyber attacks of all kinds are on the rise. Every employee, system, app, or data source is a target.

In today's digital age, especially with the emergence of AI for cyberattacks, cybersecurity is imperative. Hackers and cybercriminals are always on the lookout for vulnerabilities that they can exploit to gain access to sensitive information or cause damage. This is why security awareness training has become an essential component of cybersecurity strategy, not just a checkbox for audits.

💰 Social engineering can deceive anyone, as evidenced by the phishing attacks that targeted engineers at Twilio, a successful startup, last fall. More recently, well-known startup founder, investor, and NFT creator Kevin Rose was tricked into surrendering over a million dollars worth of digital assets. Here's what you can learn from it.

The rise of remote work has dramatically changed the way we do business, and it has also had an impact on employee training and development. As more and more companies adopt remote work policies, it is becoming increasingly important for managers to learn how to train remote teams effectively. In this post, we will discuss best practices for training remote teams and help you create a successful training program for your remote employees.

Phishing is a type of cyber attack that uses fraudulent emails or websites to trick individuals into revealing sensitive information such as passwords or financial details. These attacks are becoming increasingly sophisticated and it is essential to understand how they work and how to protect yourself. In this article, we will take a closer look at phishing templates and what you can do to stay safe.

Phishing templates are pre-made messages or emails used as part of a phishing attack. We use them as a part of our phishing simulator. At Haekka, we write some phishing templates by hand and others are created by AI, specifically GPT. In this post, we cover our favorite types of phishing templates.

There are a lot of standards in SOC 2 that companies need to address to be certified. One crystal clear standard is that companies must conduct annual security awareness training for their employees. In addition and often alongside security awareness training, companies often conduct phishing campaigns or phishing simulations.

So, what exactly is security by design? Essentially, it's the idea that security should be integrated into every aspect of the design and development process for a product, system, or service. Instead of being an afterthought, security should be a fundamental consideration from the very beginning of any project.

Meta, the parent company of Facebook, Instagram, and WhatsApp, is facing legal challenges from EU GDPR regulators. They have been fined multiple times, including a recent $400 million fine, but are appealing the penalties.

We often get asked if security awareness training needs to be graded for audits and auditors. In the context of a SOC 2, HIPAA, or ISO 27001 audit, grading of security awareness training is not required. While grading is a crucial factor in demonstrating the effectiveness of an organization's security awareness program, it is not required. 

It's sad that this news is not surprising - T-Mobile announced a data breach affecting 37 million customers. The cyber attackers managed to steal sensitive information belonging to the customers, and T-Mobile is now working hard to contain the damage.

Phishing is a prevalent tactic employed by cybercriminals, where they impersonate legitimate entities such as individuals or organizations, by creating fake email addresses and website addresses. Attackers are now using the same techniques with cryptocurrency wallet addresses.

OpenAI released ChatGPT, a new interface for its Large Language Model (LLM), at the end of November 2022 and it caused a stir in the AI world. But, turns out it also made the cyber threat landscape more exciting as it became clear that code generation could help less-skilled hackers launch cyberattacks with ease.

Slack works great as an LMS. With Haekka, you can assign training to Slack users, channels, or all users in your Slack instance. We recently wrote a guide on how to bring KnowBe4 security awareness training to Slack with Haekka. In this post, we will walk through how to bring Ninjio security awareness training to Slack.

The truth is, machine learning has already had a huge impact on social engineering, and it's not just the bad guys who are taking advantage of it. In fact, the good guys are using it too to help protect people from falling victim to scams and phishing attacks.

With our phishing simulator out of beta and available publicly, one of the most common questions we get asked by admins, and one of the most common questions we get asked by potential customers, is around the phishing templates we have available for phishing campaigns, how we create new templates, how we use ChatGPT in the process of making phishing templates, and how often we release templates.

Social engineering is a tactic used by cyber criminals to manipulate individuals into divulging sensitive information or performing actions that can lead to a security breach. It continues to be a major threat to companies because it exploits human psychology and can bypass even the most advanced technical defenses. Last year, many high-profile data breaches, such as the ones at Twilio and Dropbox, resulted from social engineering attacks.

Slack, the preferred communication platform for modern businesses and teams, works great as a modern Learning Management System (LMS). This easy and embedded approach to learning management allows for seamless communication and collaboration among learners and admins. The ease and embedded nature of a Slack LMS creates a connection between learning and learners that is hard to replicate from a traditional LMS.