Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Anyone who knows me knows I’m passionate about mindfulness. Because I genuinely believe it makes us better humans. But also, because I have one of those brains that desperately needs it. I’m easily distracted and I start new ideas before finishing old ones. My attention can scatter in a hundred directions. I wrote before how I clicked on a phishing test because I was multitasking and running on autopilot. And that moment really changed the direction of my career and my research.

When we think about misdirected email, we often put ourselves in the shoes of the sender. After all, nobody wants to tell their manager that they might (however accidentally) be responsible for a data breach. But what you do when you’re on the other side of the inbox?

Traditionally, email data loss prevention software has used static rules to stop users from emailing sensitive or confidential data. Specifically, email DLP protects organizations from accidentally exposing sensitive data such as bank account numbers, passwords, credit card numbers, intellectual property, or trade secrets.

The US Federal Bureau of Investigation (FBI) has issued an advisory warning of a phishing campaign that’s impersonating city and county officials to send phony requests for permit fees. “Individuals and businesses with active applications for land-use permits are being targeted by criminals impersonating city and county planning and zoning board officials, fraudulently requesting fees associated with these permits,” the FBI says.

Sending an unsecured email can be likened to writing sensitive information on a sticky note and leaving it on someone else's desk: anybody can intercept and share that information. Fortunately, there are ways to ensure your emails are safe from the prying eyes of hackers through encryption, meaning your message — no matter how sensitive — is seen only by the intended recipient.

In 2022, Uber's systems were breached by an 18-year-old. Multi-Factor Authentication (MFA) was active, but the attackers flooded an employee's phone with push requests until they approved one, just to stop the annoyance. Authentication worked as designed, and the attacker got in. This is, in general terms, an MFA fatigue attack. Fast forward to Q1 2025. Rapid7 found that more than 56% of all compromises resulted from stolen credentials where no MFA was in place.

More than 90% of successful cyberattacks start with email, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). That’s not because security teams lack tools, but because attackers target human decision-making. For years, organizations treated email security as a filtering problem: block enough malicious messages, and risk goes down. That assumption no longer holds.

Email Security Email Security Stop modern email-borne attacks with real-time AI defense. Please wait, this may take a few seconds... Email threat prevention is a comprehensive security technique that identifies, blocks and neutralizes email threats such as phishing, malware, and business email compromise (BEC) before they reach a user’s inbox. It combines multiple layers of defense, including AI-driven analysis, URL scanning, attachment sandboxing and authentication protocols like DMARC.

Email attacks have become one of the key ways for hackers to target organizations and individuals. The sheer number of tools available has made it easier than ever for non-technical cybercriminals to launch sophisticated cyber attacks. As a result, many resources are available for each stage of the kill chain – from reconnaissance to delivery to weaponization. This article focuses on the second stage of the cyber kill chain – weaponization.

Messaging platforms are now a major vector for phishing and other social engineering attacks, according to a new report from NCC Group’s Fox-IT. The researchers warn that legitimate messaging apps such as WhatsApp, Telegram, Discord, Signal, LinkedIn, and Gmail-integrated messaging serve as avenues through which attackers can target users while evading email security filters.