As the old saying goes, you can’t con an honest man. The claim is that every successful confidence game depends on the mark being greedy. This smacks a bit of blaming the victim but there is certainly an element of truth to it: many con games depend on the victim being hooked by the possibility of getting something for nothing.  This saying is on my mind after a recent attempt to scam me on my phone. It occurred to me that the modern version of this saying should be that you can't con a mindful user. Many scams depend on panic because panic short-circuits your ability to focus and mindfulness is your best defense against a scam. The scam that I was subjected to is not new; it was very like this one . I was watching YouTube on my phone when an official-looking dialog box popped up. The pop-up warned me that my phone’s storage was full and offered me a link to clean up my phone.  There were a number of things about this incident that were not right.: The dialog box was very nice...

Note : the picture is from the OSMEGEOS exhibit at the Hirschhorn Museum and Sculpture Garden exhibit in Washington, DC, July 2025. In May and then June we covered the  litany of the hacked , a group of entities that had been successfully hacked. The point of these litany posts is to note that this sort of thing happens and it has consequences. Pretending that you can whistle past the graveyard in cyberspace is foolish and delusional. And so, the litany of the hacked, July 2025 edition. The litany now includes: Aeroflot Airlines...Qantas Airlines...Allianz Re insurance...Rogers Communications...Tea (women-member-only date-rating site)...Elmo's account on the platform X...Microsoft's SharePoint servers... McDonald's  hiring  process assistant chatbot...CoinDCX crypto exchange...maybe the government of Singapore...City of St Paul, MN...pharmacies in Moscow, Russia... These different hacks had different purposes. Getting a Sesame Street character to spout anti-Semitism and ...

We have had multiple posts on creating impact as a CISO or an IT professional. Ultimately you won't get the impact you need to have, and professionally want to have, unless you get the attention and trust of higher-level leadership. Not having impact means you won't get the funding you need for systems or professional development, and your career may stall. We keep up with other professionals in cybersecurity, and this recent post by Ashley Rose caught our attention. Here is a part of her post that we whole-heartedly endorse, and she says it well: [M]any chief information security officers (CISOs) still find themselves speaking a technical language that fails to resonate with other leaders. Technical terms often fall flat in boardrooms more concerned with revenue growth and brand reputation. This disconnect is becoming increasingly risky as cyber incidents now directly affect stock prices, customer trust, and executive job security. Plus, boards are being held accountable a...

We're going to talk very low-tech cyberattacks. This is a story that caught our eye last week: "Bleach maker Clorox said Tuesday [22 July 2025] that it has sued information technology provider [company name withheld here] over a devastating 2023 cyberattack, alleging that the hackers pulled off the intrusion simply by asking the tech company’s staff for employees’ passwords. Clorox was one of several major companies hit in August 2023 by the hacking group dubbed Scattered Spider, which specializes in tricking IT help desks into handing over credentials and then using that access to lock them up for ransom. The group is often described as unusually sophisticated and persistent, but in a case filed in California state court on Tuesday, Clorox said one of Scattered Spider’s hackers was able to repeatedly steal employees’ passwords simply by asking for them." The hackers -- it should be noted, this is a sophisticated gang -- allegedly called the help desk for Clorox's cy...

Some things in artificial intelligence (AI) that people ohh & aahh about include the use of AI to create fake videos, write research papers, fly fighter jets, perform surgery , act as 'digital twins,' and otherwise do things that we thought only skilled sentient beings could do. That's amazing because after all AI is math, it can't prefer to do some things instead of others, and it has no way to want to do things -- it just does them. These creative uses of agentic robot features have made an impression on gangs using AI agents to engage in deception to attack cybersecurity systems.  At a very low level of a deception-based attack, the AI mimics the characteristics of a known/trusted individual and seeks access to systems that the known/trusted person should have. That's what  this post  is about.  Now, of course we've always had deception. That's the whole point of the term " Trojan horse ." That's how Lucifer breaks out of hell in the epi...

  A recent Wall Street Journal (WSJ) piece, "Hackers are targeting eldercare homes" (link here behind paywall), described successful cyberattacks against assisted living facilities. Anyone with a loved one in one of these facilities knows that, to put it bluntly, elderly people are bad at updating their security settings.  What lessons can be drawn for CISOs and CIOs of any organization?  Pythia Cybersecurity co-founder John Sebes had these thoughts about the WSJ piece and its implications. His conclusion: you have more to learn from these attacks than you think you do; will you learn anything? John's take: The elder-care services sector is the latest business sector that's being targeted by cyber-criminals, and reported on by new media including the WSJ. But both experience of the attacked businesses and the news commentary on them hold valuable lessons for any business that might need a cybersecurity upgrade. Like many organizations, all the attacked businesses t...

The long-running joke in consulting is that there is better, cheaper, and faster -- pick two.  I admit that I have muttered this same line in my consulting career. All consultants know that clients at times try to get more than what is specified in the contract -- sometimes unintentionally by for example not understanding the contract. Sometimes clients intentionally try to get more than bargained for, faster, or for less; unfortunatley that puts everyone in Alice's Wonderland . The Internet and television dramas, especially medical dramas, have exacerbated this problem. People believe that they can expect delivery overnight and that executing a project or getting results happens before the commercial break, certainly by the end of the two-part episode. We also all understand that this is not reality. But believing things that are not real are in fact real is a human thing, also known as a cognitive bias . Cybersecurity requires better, cheaper, and faster. But wait you say, we jus...