The reality is that most modern attacks do not begin with the administrator account. They begin with ordinary users. Finance teams receive invoice fraud attempts. HR staff receive malicious attachments and credential harvesting emails. Procurement and customer support teams are targeted through supplier impersonation and SaaS account compromise campaigns. Remote employees routinely interact with cloud services outside traditional network boundaries. In real life, the workforce itself has become the primary attack surface.

Someone else's credentials will get stolen. Someone else's customer database will get breached. Not us. We are too smart, we have an IT department, and we run phishing simulations.

The holiday season should be about joy, not dealing with fraud or identity theft. Staying alert and using phishing-resistant security might be the line between your end-of-year celebrations, and account recovery emails.

The common advice often depends on the victim's ability to effectively counter advanced cyber-threats. This is not a bullet-proof solution as victims of phishing attacks are no technical experts on mobile authentication.
A bullet-proof solution, is a hardware-based FIDO2 security key, which resist all adversary-in-the-middle and phishing attacks in real-time.  

Passwords were never built to handle the scale, speed, and sophistication of today’s internet. They rely entirely on the user’s skill, and hat’s a problem. We shouldn’t expect all employees to be cybersecurity experts.

Every year, organizations spend millions on cybersecurity training. By the time they reach the phishing simulation phase, they realise that the data points towards one conclusion: the employees who perform best are often…