Security awareness resources

Practical, sourced articles on human cyber risk, data protection, phishing simulation and security culture. Each one answers a question we hear often in the field.

• KVKK and Security Awareness Training: Why Employee Awareness Shapes the Data Protection Board's DecisionsWhy does a lack of employee training keep appearing in fines from Turkey's data protection board? Real decisions, common gaps and how to document training.
• Why Annual Mandatory Security Training Falls Short: The Completion Rate TrapSecurity training given once a year does not change behaviour. Why completion rates mislead, and what a continuous awareness programme does differently.
• Phishing Simulation: A Breach of Trust or a Necessary Drill?Do phishing simulations damage trust with employees? The arguments for and against, the limits of click rates, and how to design a simulation properly.
• Cybersecurity for Small Businesses: Prevention or the Cost of a Crisis?The real cost of cybersecurity for small businesses that say "nothing will happen to us". Prevention versus crisis costs, and what to do first.
• AI Phishing and Deepfakes: The New Face of CEO FraudHow do AI-written phishing emails and deepfakes that imitate an executive's voice work? Practical steps companies can take to protect themselves.
• ISO 27001, NIST, SOC 2 and NIS2: Managing Human Risk in ComplianceHow do ISO 27001, NIST and SOC 2 differ? What does NIS2 require of management bodies? The place of awareness training in compliance.
• Building a Security Reporting Culture: Why Punishing the Employee Who Clicked BackfiresPunishing an employee who clicked a phishing link hides the risk. How to build a reporting culture, and why employee silence is one of the biggest risks.
• How Should Mid-Sized Companies Allocate Their Cybersecurity Budget?Where the money goes matters more than how much there is. The most effective controls according to incident data, and a sample budget split.
• Vishing and Help Desk Impersonation: Social Engineering by PhoneAttackers who say "we're calling from IT" can even get hold of MFA codes. How vishing and help desk impersonation work, and how to protect employees.
• Passkey and MFA Security: As the Technical Lock Gets Stronger, Attackers Turn to PeoplePasskeys remove passwords, and attackers are changing tactics in response. MFA bypass, device-code phishing and the new attacks of the passkey era.
• Company Data on the Dark Web: The Price of an Attack and the Trail of LeaksA 24-hour DDoS attack costs $45 on the dark web. What happens when employee emails and passwords leak? What dark web monitoring is and why it matters.
• A Cyber Attack Is a Business Problem: Real Cases That Halted OperationsJaguar Land Rover, M&S and the Louvre: how did cyber attacks halt production, sales and operations? The shared lessons and the business continuity plan.
• How to Create a Strong Password: Length Is the SecretShort, complex passwords do not stand up to automated tools. What a passphrase is, why it is more secure and how to complete it with a password manager and MFA.
• What Does Your "Out of Office" Message Tell Attackers?The auto-reply you set before a holiday tells attackers who you are, when you are away and who is covering for you. How to write a safer message.
• Does Microsoft 365 Back Up Your Data? Common Myths About BackupMicrosoft protects the infrastructure; your data is your responsibility. The shared responsibility model, cold backup and a backup strategy against ransomware.
• Shadow AI and AI Assistants: A New Attack Surface for CompaniesEmployees are uploading company data to personal AI accounts. Shadow AI, prompt injection, the risks of AI agents and an AI use policy.
• Cybersecurity Tips for Employees: 8 Habits for Every DayFrom out-of-office replies to passphrases, from QR codes to a Friday evening check, 8 simple cybersecurity habits employees can practise every day.
• How Do You Measure Success in Cybersecurity? Discipline and Culture Over a Pile of ToolsIn cybersecurity, success means nothing happens. The AI marketing wave, the false sense of control and making cybersecurity part of company culture.