Phishing Tackle

A UK hospitality group onboarded 150 new starters ahead of a busy summer. Here was their process: 👎🏻Induction was crammed into a single 45‑minute session. 👎🏻Shared logins were handed out on sticky notes. 👎🏻A fake “welcome to payroll” email went to the new cohort. 👎🏻9 people entered their details into a spoofed portal. 👎🏻Attackers used those credentials to change bank details and divert salaries for a full pay cycle. They had decent tech: endpoint protection, email filtering, a modern HR system. None of it stopped a simple social engineering play on people who didn’t know what “normal” looked like yet. When people are new, they don’t just lack skills. They lack context. The fix isn’t throwing more policy at them. It’s building human risk into onboarding: ✅Day‑one, role‑specific training on common scams they’ll actually see. ✅Clear “this is how we’ll never contact you” rules. ✅Safe, realistic simulations with immediate feedback in their first 30 days so mistakes happen in the training, not in the wild. New starters don’t have to be your weakest link in your human risk strategy. Have a good day all ❤️🥂

“We’ve locked email right down – so we don’t really need phishing simulations or awareness training.” I still hear this in 2026. The issue is cyber criminals have moved well beyond the inbox. Today’s attacks reach your people through: 🚨WhatsApp “colleague” or “CEO” messages asking for data or urgent payments. 🚨”Tishing” (Teams/Slack/Teams-style phishing) where a link looks like a normal internal message. 🚨AI‑powered scams: deepfake voice notes, highly personalised BEC messages, multi‑channel social engineering. Research continues to show that most breaches start with human-driven factors like phishing and social engineering, not pure technical exploits. Annual tick‑box training and a good email filter don’t change behaviour; ✅ongoing, realistic simulations ✅just‑in‑time micro‑training do. Modern cyber resilience expectations are shifting towards culture, behaviour, and demonstrable training – not just having tools and policies on paper. If your human risk strategy only covers email, you’re effectively telling attackers: “Call us, message us on WhatsApp, send a Teams link - that perimeter is wide open.” I’m curious – when you talk about “phishing training” in your organisation, does it genuinely include WhatsApp, Teams/Slack, SMS and voice, or is it still 95% about the inbox? 👇 Happy Monday all ❤️🥂

How to Actually Measure Human Risk... Beyond Just Clicks. When it comes to human risk, the most common risk metric used by companies is click data. The issue with this? Clicks alone don’t tell you the whole story. For example… 🤔 A brand-new intern clicks on a phishing email, but is that really a risk? 🤔 Or is it the HR Director with access to sensitive data who poses the bigger threat? 🤔 Or maybe it's the Finance Director who’s been around long enough to have internal access but hasn't clicked a malicious link yet? The truth is, not all risks are created equal. At Phishing Tackle, we’ve taken a different approach to measuring human risk. Instead of relying on generic metrics, we empower you to create a customised risk profile for every individual in your organisation, from your interns to your C-suite. With our platform, you can: ✅ Assign weightings to departments (like Finance and HR) where risk is inherently higher. ✅ Integrate breach data to evaluate past incidents and refine your metrics. ✅ Track training progress: Did the employee go through their security training? Have they been flagged for risky behaviour? ✅ Build a traffic light system for easy, at-a-glance risk assessment, based on the metrics you care about. Why does this matter? Because, simply measuring clicks doesn’t give you the whole picture. When you factor in department, role, training status, and past behavior, you're able to make informed decisions about where to focus your efforts. And that’s what Phishing Tackle is all about: giving you full visibility into the human risk landscape, so you can protect your organisation from the inside out. Want to learn more about how we’ve helped companies like yours? Watch my mini demo here for a deeper dive into how Phishing Tackle’s platform works to better measure, mitigate, and manage your cybersecurity risks. Have the best Tuesday all ❤️🥂

Are your C Suite too important to be phished? I’ve been in this industry for 9 years, and hear repeatedly how the senior executives refuse to be part of the human risk strategy. ❌The “I’m too senior to be phished” CEO. ❌They don’t click training links. ❌They don’t attend awareness sessions. ❌They proudly say things like, “Id always spot a scam.” Meanwhile, attackers are literally designing sophisticated campaigns for people exactly like them. Their name is public, their email is public and their calendar is full. They approve big payments, sign deals, and have access to the crown‑jewel data. Their inbox is a social engineer’s dream: urgency, authority, and zero time to double‑check. On paper, they’re “exempt from training”. In reality, they’re the highest‑value target in the company. The irony of this? The CEO would never accept a revenue leader saying, “I’m too important to use the CRM.” But somehow, “I’m too important for phishing training” is often accepted. The organisations that get this right do something different: ✅They build ultra‑concise, executive‑only training that respects time. ✅They show real examples of CEO fraud, deepfake voice scams, and business email compromise that cost companies millions. ✅They make it clear: being senior means being more protected and more prepared - not exempt. If culture really flows from the top, then so does human risk. 👇 What’s your experience on this? Have you met the “unphishable” exec - and was there an event that finally convinced them they weren’t actually invincible? Happy Tuesday all ❤️🥂

Insurers are flagging human error in the majority of cyber claims. How can you build a culture of awareness and compliance?

Phishing is still the costliest way for attackers to get in, and insurers know it. Find out what they want you to do about it.