Bahadır Şahin
Bahadır Şahin is the founder of InfoLore. He runs the full cycle of awareness programmes for organisations, from needs analysis to impact reporting.
He spent more than fifteen years at Turkcell and Türk Telekom, in strategic segment sales and solution management at Turkcell and in managing the professional services segment at Türk Telekom. He then worked in cybersecurity channel management and consulting at Elcore Group and Digital Deals, with vendors and distributors of solutions such as EDR, XDR, NDR and SASE.
He completed the Digital Transformation Leadership programme at Koç University and the MIT IoT Bootcamp. He is the author of "Outrun the Lion", a book on human error in cybersecurity. In 2026 he spoke on cybersecurity at Dicle University. He mentors on the ITU Çekirdek, Tech Istanbul and ÇYDD (Association for Supporting Contemporary Life) programmes.
Articles
- KVKK and Security Awareness Training: Why Employee Awareness Shapes the Data Protection Board's DecisionsWhy does a lack of employee training keep appearing in fines from Turkey's data protection board? Real decisions, common gaps and how to document training.
- Why Annual Mandatory Security Training Falls Short: The Completion Rate TrapSecurity training given once a year does not change behaviour. Why completion rates mislead, and what a continuous awareness programme does differently.
- Phishing Simulation: A Breach of Trust or a Necessary Drill?Do phishing simulations damage trust with employees? The arguments for and against, the limits of click rates, and how to design a simulation properly.
- Cybersecurity for Small Businesses: Prevention or the Cost of a Crisis?The real cost of cybersecurity for small businesses that say "nothing will happen to us". Prevention versus crisis costs, and what to do first.
- AI Phishing and Deepfakes: The New Face of CEO FraudHow do AI-written phishing emails and deepfakes that imitate an executive's voice work? Practical steps companies can take to protect themselves.
- ISO 27001, NIST, SOC 2 and NIS2: Managing Human Risk in ComplianceHow do ISO 27001, NIST and SOC 2 differ? What does NIS2 require of management bodies? The place of awareness training in compliance.
- Building a Security Reporting Culture: Why Punishing the Employee Who Clicked BackfiresPunishing an employee who clicked a phishing link hides the risk. How to build a reporting culture, and why employee silence is one of the biggest risks.
- How Should Mid-Sized Companies Allocate Their Cybersecurity Budget?Where the money goes matters more than how much there is. The most effective controls according to incident data, and a sample budget split.
- Vishing and Help Desk Impersonation: Social Engineering by PhoneAttackers who say "we're calling from IT" can even get hold of MFA codes. How vishing and help desk impersonation work, and how to protect employees.
- Passkey and MFA Security: As the Technical Lock Gets Stronger, Attackers Turn to PeoplePasskeys remove passwords, and attackers are changing tactics in response. MFA bypass, device-code phishing and the new attacks of the passkey era.
- Company Data on the Dark Web: The Price of an Attack and the Trail of LeaksA 24-hour DDoS attack costs $45 on the dark web. What happens when employee emails and passwords leak? What dark web monitoring is and why it matters.
- A Cyber Attack Is a Business Problem: Real Cases That Halted OperationsJaguar Land Rover, M&S and the Louvre: how did cyber attacks halt production, sales and operations? The shared lessons and the business continuity plan.
- How to Create a Strong Password: Length Is the SecretShort, complex passwords do not stand up to automated tools. What a passphrase is, why it is more secure and how to complete it with a password manager and MFA.
- What Does Your "Out of Office" Message Tell Attackers?The auto-reply you set before a holiday tells attackers who you are, when you are away and who is covering for you. How to write a safer message.
- Does Microsoft 365 Back Up Your Data? Common Myths About BackupMicrosoft protects the infrastructure; your data is your responsibility. The shared responsibility model, cold backup and a backup strategy against ransomware.
- Shadow AI and AI Assistants: A New Attack Surface for CompaniesEmployees are uploading company data to personal AI accounts. Shadow AI, prompt injection, the risks of AI agents and an AI use policy.
- Cybersecurity Tips for Employees: 8 Habits for Every DayFrom out-of-office replies to passphrases, from QR codes to a Friday evening check, 8 simple cybersecurity habits employees can practise every day.
- How Do You Measure Success in Cybersecurity? Discipline and Culture Over a Pile of ToolsIn cybersecurity, success means nothing happens. The AI marketing wave, the false sense of control and making cybersecurity part of company culture.