How to Choose a Cybersecurity Awareness Month Speaker Who Engages AND Changes Behavior

A professional, high-resolution image featuring an October calendar icon paired with a digital shield and lock on a computer screen, symbolizing effective Cybersecurity Awareness Month training.

The best cybersecurity awareness speakers don’t just explain threats. They change what people do when the suspicious email, urgent payment request, or fake login screen actually appears.

October has a way of turning cybersecurity into broccoli. Everyone agrees it is good for them. Nobody is particularly excited when another serving appears on the calendar. Cybersecurity Awareness month often brings up these feelings each year. Cybersecurity Awareness Month can quickly become a blur of phishing simulations, intranet reminders, posters, mandatory training modules, and emails telling employees not to click suspicious emails—which, naturally, arrive by email. A great Cybersecurity Awareness Month speaker will break that pattern.

The right speaker does more than explain ransomware, phishing, deepfakes, or whatever terrifying acronym has joined the threat landscape this year. They make cybersecurity personal, recognizable, and most importantly, actionable. Because the real goal isn’t to turn every employee into a cybersecurity expert.

It’s to help people make one better decision when it matters.

Start With Behavior, Not the Speaker Bio

Before watching speaker reels or comparing credentials, decide what you want your audience to do differently after the presentation.

That sounds obvious. It often isn’t.

“We want employees to be more aware of cybersecurity” is not really an outcome. It’s a hope.

Better outcomes sound more like this:

  • Employees verify unusual payment or password requests before acting.
  • People report suspicious messages quickly instead of quietly deleting them.
  • Executives understand how attackers manipulate urgency and authority.
  • Employees use stronger authentication and safer password practices.
  • Teams become more comfortable saying, “Something about this doesn’t feel right.”

Different audiences require different conversations.

An all-employee Cybersecurity Awareness Month kickoff is not the same as a board presentation. Finance teams face different risks than sales teams. Healthcare, financial services, government, education, manufacturing, and professional services all have their own versions of “normal”—and criminals are very good at exploiting normal.

A good speaker understands the difference.

Customization shouldn’t mean pasting your company logo onto slide number three. It should mean connecting proven security lessons to the decisions your people actually make.

Cybersecurity Is a Human Problem Wearing a Technology Costume

Technology matters enormously in cybersecurity. But attackers increasingly succeed by going around the technology and targeting the person using it.

They manufacture urgency.

They impersonate authority.

They exploit helpfulness.

They borrow trust.

And with artificial intelligence making phishing, impersonation, voice cloning, and social engineering faster and more convincing, the old advice to simply “look for bad grammar” is becoming about as useful as telling someone to identify counterfeit money by squinting harder.

Employees need to understand how manipulation works.

That is one reason live presentations can succeed where static training struggles. A strong speaker can put an audience inside a realistic situation and show how a perfectly reasonable decision becomes the first step in a very unreasonable disaster.

Once people understand the psychology behind the attack, cybersecurity stops being a collection of rules. It becomes pattern recognition.

 

Look for Credibility—and the Ability to Translate It

Cybersecurity credentials matter, particularly when your audience includes IT, risk, compliance, privacy, legal, or security professionals. But expertise and communication are different skills. Someone can understand a threat at extraordinary technical depth and still leave 800 employees wondering what just happened for the past 60 minutes.

The best cybersecurity speakers translate complexity without dumbing it down.

They can explain credential theft, business email compromise, deepfakes, account takeover, ransomware, or AI-enabled fraud in language a nontechnical audience immediately understands.

Just as important, they understand the human consequences.

Cybercrime is not merely about compromised servers and stolen data. It affects careers, customers, companies, families, reputations, finances, and sometimes entire organizations.

That human connection matters.

My own work in cybersecurity began after my identity was stolen and used to commit crimes. The experience destroyed my business, damaged my finances, and nearly landed me in jail for crimes I didn’t commit. That changes the way you talk about cybersecurity.

For me, it has never been primarily about technology. It is about what happens to people when the technology fails—or when another human being is manipulated into making the wrong decision.

The Best Cybersecurity Awareness Makes Threats Visible

A cybersecurity keynote should not feel like someone reading the glossary from a security textbook. Yes, audiences may need to understand terms such as ransomware, business email compromise, deepfakes, credential theft, account takeover, and zero trust. But knowing the vocabulary is not the same as recognizing the attack.

The strongest presentations show people what the dangerous moments actually look and feel like. An unexpected Microsoft 365 login. A Zoom video conference supposedly from the CEO. A vendor asking for updated banking information. A phone call from someone who sounds exactly like a colleague. A QR code that leads somewhere it shouldn’t.

A message that creates just enough urgency that your brain says, I’ll deal with this quickly and get back to what I was doing. That last moment is where much of cybersecurity lives.

Stories, demonstrations, and realistic scenarios help employees recognize those moments before they become incidents. The goal should never be to impress the audience with how clever hackers are.

The goal is to make the audience harder to manipulate.

Fear Gets Attention. Confidence Changes Behavior.

Cybersecurity has no shortage of frightening statistics. And occasionally, fear is useful. Cybercrime has real consequences, and pretending otherwise doesn’t help anyone.

But a security program built entirely around fear creates another problem. People become afraid of making mistakes. And when people are afraid of making mistakes, they often hide them. That is disastrous in cybersecurity.

If someone clicks something suspicious, reports it immediately, and gives the security team time to respond, a potential incident may remain a very small problem. If that person waits three days because they are embarrassed? Different story.

A strong cybersecurity culture rewards curiosity and early reporting.

People will make mistakes. The goal is to create systems and behaviors that catch those mistakes before attackers can turn them into catastrophes.

Personal Protection Makes Workplace Cybersecurity Stronger

One of the most effective ways to engage employees is to show them that cybersecurity doesn’t end when they leave work. The same criminal techniques used against businesses are used against families. Identity theft. Bank fraud. Account takeover. Fake delivery messages. Investment scams. Romance scams. AI-generated impersonation. Password theft.

When employees realize that better cybersecurity habits can protect their children, parents, retirement accounts, credit, and identity, not just the corporate network, the subject becomes immediately more relevant. And relevance drives behavior.

People rarely wake up thinking, Today I would like to improve my organization’s security posture. They do care about protecting their paycheck and their family. Start there.

Choose the Right Format

The format should match what you want the event to accomplish.

A keynote is ideal when you want shared energy, a common security language, and a memorable experience across a large audience.

A breakout session is a perfect addition for when the group needs deeper discussion, scenarios, or Q&A.

A leadership session can focus on decision-making, culture, crisis response, business continuity, and the unique ways executives are targeted.

Many organizations combine them: a keynote for the broader workforce followed by targeted sessions for leaders or higher-risk teams.

But bigger isn’t automatically better.

If your budget allows for only one event, I would rather see an organization deliver one exceptional experience and reinforce five memorable ideas afterward than spread resources across ten forgettable security activities simply because October has 31 days that need filling.

Avoid the Biggest Cybersecurity Awareness Month Mistake

The biggest mistake is treating October as the finish line. Cybersecurity Awareness Month should be a catalyst, not an annual compliance ritual. A strong speaker gives your organization stories, language, and behaviors you can reinforce long after the event ends.

That might mean referencing a memorable demonstration in future phishing simulations. Repeating a simple verification rule (like Hogwash, which is my engaging way of keeping them laughing AND detecting fraud). Including a concept from the keynote in onboarding. Giving managers language they can use with their teams. Reinforcing the idea that reporting something suspicious is a success—not an admission of failure.

The keynote creates the moment. Your culture determines whether the moment lasts.

Choose the Speaker Who Makes the Next Decision Better

Ultimately, the best Cybersecurity Awareness Month speaker isn’t the person who can describe the most sophisticated attack. It is the person who can make a sophisticated attack understandable.

Someone who can hold the attention of both the cybersecurity professional in the front row and the employee in the back who came because Outlook placed the meeting on their calendar.

Someone who makes people laugh without trivializing the risk.

Someone who makes cybercrime real without making people feel helpless.

And someone who leaves the audience thinking:

I know what to look for. I know what to do. And if something feels wrong, I’m going to speak up.

That is cybersecurity awareness worth remembering.

And it lasts a lot longer than October.

Connect with John for your engaging, unforgettable Cybersecurity Awareness Month training! https://sileo.com/contact-us/

When Caller ID Lies: How the New Zelle Scam Works

I’ve written about hundreds of scams. Crypto. Pig butchering. Nigerian-princes so obvious they wear plastic crowns studded with costume jewelry. But there’s a new one, and unfortunately for victims, it’s working incredibly well. 

Your phone rings. The Caller ID says “Wells Fargo.” The person on the line knows your name and says they’ve detected suspicious Zelle activity—money being sent to Las Vegas on a new bank account established in your name. Uncharacteristically, they give you information instead of asking for it. Case numbers. Cancellation codes. A long reference ID that you carefully note.

The scammer’s first secret is to overwhelm our brains with data, because we trust details. 

“How do I know this isn’t fraud?” you ask. The response is deviously reassuring : “You’re right to be concerned, so let me transfer you to my supervisor. Please be advised that Wells Fargo will never ask for your password.” 

The scammer’s second secret is to mention security and pass you on to higher authority, a tactic to put you at ease so you take your eye off the ball. 

The supervisor comes on. Different voice. Confident. But you’re still suspicious, because you dutifully watch John Sileo’s videos! 😀

The supervisor asks you to google the phone number of the bank branch in your neighborhood. Which you do. The number matches the caller ID on your phone. You know it’s easy to spoof a phone number and use AI to gather personal details, but you’re already invested and the longer you’re on the phone, the more your guard lowers.

The supervisor says it’s easy to reverse the transaction together. And that’s the moment… 

When they start asking you to DO SOMETHING, the alarm bells should ring. There is no “together” in banking. The bank has all the power. All of the information. 

If you hadn’t just hung up, they’d tell you to open Zelle or Venmo and enter an amount: $3000. Then, instead of a phone number, they ask you to enter the “case number” they’ve given you, but to delete the letters off the front end. Which turns it into a 10-digit phone number to which you are transferring money.

Scammers lull their victim into the “task performance” zone, where they are more focused on completing steps than thinking critically.  

This scam, like nearly every type of cybercrime I speak on, isn’t about hacking technology. It’s about momentarily hacking human attention using urgency, authority, cognitive overload and real-life data. And the only effective answer is to build a proper anti-fraud reflex before the call comes in.  

Let’s strengthen your cyber-defense muscle by training people to think critically, recognize red flags, and stay one step ahead of fraud. If your workplace, organization, or community could benefit, let’s explore the options together. Email [email protected]. 

 

Hacked Minds, Not Systems: Why AI-Powered Fraud Is the New Cybersecurity Crisis

Ransomware hasn’t disappeared—it has evolved. Today’s threat is more sophisticated, more scalable, and far more dangerous: cyber-enhanced fraud. Powered by AI, attackers are no longer just targeting systems—they’re targeting people. And unlike software, humans don’t receive automatic security updates.

While organizations have invested heavily in strengthening their technical defenses, most remain critically vulnerable on the human side. In fact, an estimated 90% of organizations are unprepared for AI-driven, conversation-based attacks that exploit trust, urgency, and authority.

The solution isn’t more alerts or more tools. It’s better human judgment.

That’s where the “Hogwash and Verify” framework comes in—training individuals to instinctively question suspicious requests and verify them through trusted channels. When skepticism becomes a reflex, organizations can prevent catastrophic mistakes before they happen—like a fraudulent $100 million wire transfer.

The New Cyber Reality: From Ransomware to Human Hacking

For years, ransomware dominated the cybersecurity conversation. High-profile breaches demonstrated just how costly system vulnerabilities could be. But today’s attackers have found a more efficient path: bypassing systems entirely and manipulating people instead.

Why? Because it’s easier.

Rather than breaking through firewalls, cybercriminals are exploiting the most unpredictable—and often least protected—part of any organization: human decision-making. A convincing message, a sense of urgency, or a familiar voice is often all it takes.

Compounding the risk is a major insurance gap. Many organizations assume they’re protected, only to discover that policies often exclude losses resulting from “authorized” actions—like an employee willingly transferring funds based on a fraudulent request.

How AI Is Supercharging Cybercrime

Artificial intelligence has dramatically lowered the barrier to entry for cybercriminals while increasing the effectiveness of their attacks.

  1. Eliminating Red Flags
    Gone are the days of obvious phishing emails riddled with typos. AI enables attackers to craft polished, professional, and highly convincing messages—removing the friction that once made scams easier to spot.
  2. Deepfake Technology
    Attackers can now replicate voices and video with alarming accuracy. In one case, an employee transferred $25 million after attending a live video call featuring a deepfake of their CEO.
  3. Scalable Personalization
    AI allows criminals to conduct deep research on employees in seconds. From LinkedIn profiles to company announcements, attackers can tailor messages that feel personal, relevant, and legitimate—making phishing and smishing attacks far more effective.

The Human Defense: “Hogwash and Verify”

To counter these evolving threats, organizations must equip their people with a simple, repeatable mental model:

  1. Hogwash (The Trigger)

This is the instinctive reaction. Any unexpected request involving money, sensitive data, or credentials—especially those marked urgent—should immediately raise suspicion.

Think of it as building a reflex:
Pause. Question. Assume it could be fraudulent.

  1. Verify (The Response)

Once suspicion is triggered, verification must follow—but not through the same channel.

  • Don’t reply directly to the message 
  • Don’t click the provided link 
  • Use a trusted, independent method (like calling a known number) to confirm the request 

This simple two-step process creates a powerful safeguard against even the most sophisticated attacks.

Lessons from the Real World

The impact of cyber-enhanced fraud is already playing out across industries:

  • MGM Resorts suffered a $110 million loss after a hacker manipulated an IT help desk into resetting credentials. 
  • A fraudulent website mimicking Tesla’s branding successfully tricked users into handing over sensitive login information. 
  • In a near-miss at Ferrari, an executive noticed something subtle—a slight inconsistency in tone during a deepfake video call. By asking a personal question only the real CEO could answer, they prevented a major financial loss. 

These examples highlight a critical truth:
Technology alone doesn’t stop attacks—people do.

The Bottom Line

Right now, AI is giving attackers the advantage. They move faster, adapt quicker, and operate without regulatory constraints. While defensive technologies continue to improve, they are not enough to address the growing threat of human-targeted attacks.

Your strongest line of defense isn’t another tool—it’s a trained, alert, and empowered workforce.

Organizations that teach their teams to stop, slow down, and think will have a decisive edge. Because in a world of AI-driven deception, the ability to question, verify, and act with intention is what prevents the next major breach.

And sometimes, all it takes is one person saying:
“This doesn’t feel right.”

 

Want help putting these safeguards in place? Let’s talk: [email protected]

 

 

Are Your Employees Accidentally Leaking Sensitive Data to AI?

In today’s fast-paced, AI-everywhere world, connecting tools like ChatGPT, Gemini, or Claude to your company’s cloud storage—Google Drive, Dropbox, OneDrive—feels like the smart move.

💡 Automate more.
🧠 Think less.
⚡ Move faster.

But here’s what too many companies don’t realize: These integrations, while convenient, can quietly open the floodgates to serious security and privacy risks.

The Unseen Risks Lurking in AI Integrations

When your team links AI tools to company drives, they might think they’re granting access to a single file — but they could be giving away the keys to the whole kingdom.

Take Microsoft’s OneDrive File Picker, for example. Thanks to the way OAuth permissions work, an AI app might get read access to your entire OneDrive, even if the user only intended to share one folder. 😬

Even more concerning? Integrations with ChatGPT and other AI tools can pull sensitive data—financials, HR records, trade secrets—straight into responses, or worse, into training datasets.

And cybercriminals? They love complexity and blind spots. AI integrations are becoming a new playground for exploitation and backdoor entry.

How to Protect Your Data Without Ditching AI

Let’s be clear: we’re not saying ditch AI tools. The productivity gains are real. But you can (and should) use AI responsibly. Here’s how:

1. Limit Access to Only What’s Needed

Don’t link an entire shared drive. Seriously.
Instead, grant access at the folder level, and only to the files needed for a specific task. Less access = less risk.

📚 OpenAI’s documentation backs this up.

2. Opt Out of AI Model Training

Every time your team chats with ChatGPT, they could be sharing confidential data. By default, that data might be used to train future models.

But there’s good news:
You can turn that off.

Go to Settings > Data Controls and uncheck “Improve the model for everyone.”
✅ No more data sharing.
✅ More peace of mind.

As OpenAI spokesperson Taya Christianson put it: “We give users multiple easy-to-access ways to control how their data is used.”

And if you’re an enterprise customer? Your data isn’t used for training at all—unless you say so.

Even with images (yes, DALL·E fans), you can opt out of having them included in future model training via a simple form. Got a lot of content online? Use a robots.txt file to block AI crawlers. Most major AI companies honor it.

3. Stay Compliant (Seriously)

Working in finance, healthcare, or law? Regulations like HIPAA, GDPR, or CCPA aren’t optional.

Regular audits, encryption, and clear data retention policies should be baked into your AI strategy from the start.

4. Audit & Revoke Access Regularly

Set a calendar reminder. Seriously. Do a quick monthly check on what’s connected, who has access, and whether those tools are still needed.

And if something looks fishy? Revoke access immediately.

✅ Bottom Line: Use AI, But Use It Wisely

AI tools can transform how we work — but without proper oversight, they can also become massive liabilities.

With the right guardrails in place, your organization can unlock the full power of AI without putting your most valuable data at risk.

Because when it comes to data breaches?
Preventing one is a lot cheaper (and less embarrassing) than cleaning up the mess after.

Want help putting these safeguards in place? Let’s talk: [email protected]

Your 23andMe DNA Is Up for Sale: Here’s How to Protect It Before It’s Too Late

If you’ve ever submitted your DNA to 23andMe, now is the time to act. The company has filed for bankruptcy, and buried deep in their user agreement is a disturbing clause: they can sell your genetic data to whoever offers the highest bid. And that’s not a hypothetical—at one point, a major pharmaceutical company was the highest bidder for millions of profiles. Your DNA, including markers for disease risk, ancestry, and physical traits, could soon belong to corporations, insurers, or even foreign governments—all without your explicit consent.

Here’s the problem: HIPAA doesn’t apply. Genetic testing companies like 23andMe aren’t bound by the same privacy protections as your doctor’s office. That means your most intimate biological data—your blueprint—can be sold off with fewer restrictions than your medical records from a routine check-up. Imagine a world where insurers hike your rates based on a gene you didn’t know you had. Or a world where governments use inherited markers to surveil or discriminate. That world is a lot closer than you think.

But you still have a window to protect yourself. The good news? You can download your data and delete your account before it changes hands. This includes requesting that your physical DNA sample be destroyed. Here is a step-by-step guide:

To completely delete your data:

  1. Log into your 23andMe account and navigate to “Settings.”
  2. Scroll down to the bottom to “23andMe Data” and click “View.”
  3. Scroll down to the bottom of this page and add your birthdate. Click “Delete Your Data.” You will then be taken to another page where you will choose “Permanently Delete Data.” This begins the irreversible process of removing all your genetic information from 23andMe’s systems.
  4. You should receive a message stating that 23andMe received your deletion request, but you need to confirm it by clicking a verification link sent to your email address. This two-step process is designed to prevent accidental deletions.
  5. Access the email titled “23andMe Delete Account Request.” Click the “Permanently Delete All Records” button at the bottom of the email. You will be taken to a confirmation page that states “Your data is being deleted.”
  6. After completing these steps, you should receive a final confirmation email from 23andMe acknowledging that your data deletion request has been processed. Keep this email as documentation of your deletion request.
  7. If you don’t receive confirmation within a reasonable timeframe (typically 30 days), contact 23andMe customer service directly to ensure your deletion request was properly processed.

The implications of this go far beyond 23andMe. This moment is a wake-up call for every person who’s handed over their DNA to a private company. Even if you didn’t, a close relative might have—and your genetic data overlaps with theirs. Once it’s out there, it’s nearly impossible to reclaim.

The 23andMe bankruptcy shows us how vulnerable we really are when it comes to genetic privacy. So take control while you still can. Download your data. Delete your account. And demand that companies treat your DNA with the same respect as your identity—because that’s exactly what it is.

Concerned about how your team is handling security threats like this—and the dozens more we face every day? Let’s start the conversation. Reach out at [email protected].

The Great Pretenders: How North Korea Turned Remote Work Into a Weapon

Picture this: You’re interviewing a promising software developer who aced the technical screening. Their resume sparkles. Their code samples shine. There’s just one tiny red flag—when you ask about their favorite Halloween candy, they go silent. Not because they’re diabetic or health-conscious, but because they’ve never heard of trick-or-treating.

Welcome to the world’s most sophisticated employment scam, where North Korean operatives have turned America’s remote work revolution into their personal ATM—and potential cyber weapon.

VIDEO: Did You Hire a Hacker? The Latest Cyberattack Starts Inside Your Organization

The Infiltration Game: More Common Than Your Morning Coffee

“If a company thinks they haven’t been targeted, that probably means they’ve already hired one,” warns Brandon Wales, former executive director of the U.S. Cybersecurity and Infrastructure Security Agency. That’s not hyperbole—that’s math. SentinelOne received over 1,000 applications from suspected North Korean infiltrators in a single year.

These aren’t amateur hour operations. We’re talking about skilled developers earning six-figure salaries—sometimes juggling multiple jobs simultaneously—all while funneling American paychecks straight to Pyongyang’s coffers.

Think of it as the ultimate remote work hack, except instead of working from a beach in Bali, they’re working from a totalitarian regime with nuclear ambitions.

The Perfect Storm: When Good Intentions Meet Bad Actors

Remote work opened doors we never meant to unlock. The same flexibility that lets your best developer work from Colorado while living in Vermont also creates perfect cover for someone working from Pyongyang while pretending to live in Phoenix.

These digital chameleons have mastered the art of American corporate camouflage. They provide U.S. addresses during hiring, then conveniently “move” during onboarding, requesting equipment shipments to different states. They’re technically competent—genuinely skilled at the jobs they’re applying for. But ask them about local burger joints or Halloween traditions, and suddenly their American facade crumbles faster than a stale fortune cookie.

Red Flags That Actually Matter: Your Detection Playbook

Smart companies are fighting back with surprisingly simple tactics. Here’s what works:

The Camera Dodge: North Korean operatives rarely appear on video calls, and when they do, they’re hiding behind virtual backgrounds or filters. Ask interview candidates to wave their hands in front of their faces during video calls. Consumer-grade deepfake technology glitches under this simple test, revealing the deception underneath.

Cultural Blindspots: America’s shared cultural experiences become powerful authentication tools. Questions about local restaurants, seasonal traditions, or regional quirks expose pretenders who’ve studied technical manuals but never lived the American experience.

Intelligence Sharing: Industry groups maintain databases of known impostor email addresses and identifiers. Nicholas Percoco from Kraken cryptocurrency exchange discovered their North Korean applicant this way—a simple database match that triggered days of careful observation to understand the enemy’s methods.

Background Check Failures: Here’s the scary part—traditional background checks often pass these operatives because they’re using stolen real identities. The system designed to protect us becomes complicit in the deception.

Beyond Paychecks: The Real Cyber Threat

Money is just the appetizer. The main course is access.

Some infiltrators immediately attempt installing malware and backdoors on company systems. Others play the long game, establishing legitimate access that could be weaponized later. Imagine thousands of North Korean operatives embedded in American tech companies, waiting for activation like sleeper cells in a cyber thriller.

Charles Carmakal from Google’s Mandiant has witnessed operatives attempting extortion after termination—threatening to release company data unless paid bonuses. It’s digital hostage-taking with a bureaucratic twist.

The Solution Arsenal: Fighting Back Intelligently

The most effective defense combines high-tech detection with low-tech human insight:

Layer Your Security: Implement location verification that cross-references claimed addresses with actual login locations. If someone claims to live in Denver but consistently logs in from Southeast Asia, that’s worth investigating.

Invest in AI Detection: Advanced deepfake detection technology is becoming essential hiring infrastructure, not optional security theater.

Trust But Verify: Create multi-stage verification processes that test both technical skills and cultural authenticity throughout the hiring pipeline.

Human Resources as First Responders: Train HR teams to recognize infiltration patterns and escalate suspicious applications to security teams before technical interviews begin.

The Optimistic Reality: We’re Getting Smarter

Here’s the encouraging truth—awareness is spreading faster than the threat. Companies like KnowBe4 detected and stopped malware installation attempts within hours. Kraken’s security team turned their infiltrator discovery into valuable intelligence gathering.

The cybersecurity community is sharing threat intelligence more effectively than ever. What once caught companies off-guard is now becoming predictable, detectable, and preventable.

Your Action Plan: Three Steps to Protection

First, audit your hiring process for cultural verification points. Add questions that require lived American experience, not Wikipedia research.

Second, upgrade your video interview protocols. Require camera-on meetings with simple physical verification tests that defeat basic deepfake technology.

Third, connect with industry intelligence sharing groups. The email address that fooled your competitor last month doesn’t need to fool you this month.

The Bottom Line: Turning Tables on the Tricksters

North Korea’s IT infiltration scheme succeeds because it exploits our good intentions—our desire for diverse, remote talent and inclusive hiring practices. But those same values, properly protected, become our greatest strengths.

The regime that can’t keep its lights on is trying to hack our electrical grid through employment applications. The irony would be funny if the stakes weren’t so serious.

But here’s what Kim Jong Un didn’t count on: American ingenuity adapts faster than authoritarian schemes evolve. We’re learning, sharing, and building defenses that turn their greatest weapon—deception—into their most obvious weakness.

The great pretenders may be skilled developers, but they’re terrible Americans. And in the end, that cultural authenticity gap might just be their undoing.

The next time you’re interviewing remote candidates, remember—the best security question might not be about coding algorithms. It might be about candy.

Empower your team with the knowledge they need to stay safe. Cybersecurity threats are evolving every day—don’t let your organization fall behind.

Let’s start the conversation today: https://sileo.com/contact-us/

A Wildly UN-BORING Cybersecurity Awareness Month: How to Make Security Training People Actually Want to Attend

When most employees see Cybersecurity Training pop up on their calendars, their first instinct is to feign a mysterious illness. It’s no wonder: Cybersecurity Awareness Month (CSAM) has earned a reputation for being the corporate equivalent of watching paint dry. But in a world where cybercriminals are evolving into full-fledged criminal enterprises—complete with HR departments and holiday parties—it’s time we gave security training the glow-up it desperately needs.

Here’s how to make this October’s CSAM wildly un-boring—and, more importantly, wildly effective.

1. Make the Fundamentals Feel Like Insider Intel

You lose your audience the moment you start with “password hygiene.” Instead, open with urgency: “Here’s how hackers used A.I. to steal $1.7 billion in crypto and hijack patient health records.” That’s when eyes open and pens come out.

While the fundamentals are still the most critical defense (hello, multi-factor authentication), don’t present them as basics. Frame them as the “stuff hackers don’t want you to know”—because that’s exactly what they are. Dress up the content in compelling narratives and real-world stakes.

Even better? Gamify it. Turn MFA adoption into a “Least Hackable Department” contest. Security becomes a game. Engagement goes through the roof.

2. Make AI the Villain—With a Plot Twist

If you want to grip your audience, give them a good villain. In 2025, that villain is AI. Show how it’s being used to craft eerily convincing phishing emails, generate ransomware code, and create deepfakes that could fool a world leader.

But don’t just lecture—show it. Host an internal “phishing competition” where teams use AI to create their own deceptive emails (with ethical guardrails). This type of hands-on learning sparks lasting behavior change.

Then flip the script. Reveal how AI can also be a defender—spotting malicious links, identifying deepfakes, and analyzing unusual activity. That’s your plot twist: AI is both the villain and the superhero.

3. Turn Humans Into Heroes, Not Punchlines

Yes, most breaches begin with human error—but beating people over the head with that doesn’t help. Instead, reframe employees as your “human firewall.” Share stories of real workers who spotted scams and thwarted attacks by trusting their gut.

Create a “Security Champion of the Month” program. Recognize vigilance with visibility and rewards. People want to be heroes, not the next cautionary tale in a team meeting.

You can even run security-themed escape rooms, scavenger hunts, or “spot the phish” challenges. When people are engaged, they’re more likely to remember—and apply—what they’ve learned.

4. Say Goodbye to Digital NyQuil

The fastest way to destroy security culture? Slap together a generic slideshow and a monotone narrator. Instead, embrace “edutainment.” Bring in a social engineering expert. Run live hacking demos. Host casual AMAs with your security team.

And above all, make it personal. Show how these principles protect not just the company, but employees’ private photos, banking info, and digital identities. When people see the personal value, professional compliance follows naturally.

Serve content in bite-sized portions—a weekly 5-minute tip beats a two-hour snooze-fest every time.

Final Thought: Don’t Be Boring

Cybercriminals are dynamic, creative, and relentless. If your defense strategy is static, dull, and forgettable… they’ve already won.

Cybersecurity Awareness Month is your moment to flip the script—transforming training from something employees dread into something they remember, apply, and maybe even enjoy.

Because when it comes to cybersecurity, boring is the biggest risk of all.

John Sileo is a high-energy cybersecurity keynote speaker and award-winning author who turns boring security training into unforgettable, action-inspiring experiences. If you’re ready to make security awareness stick—and actually get people to care—reach out and start the conversation: sileo.com/contact-us 

When Encryption Isn’t Enough: How Human Error Undermines Even the Best Security Tools

In the realm of cybersecurity, we often focus intensely on technical solutions—better encryption, stronger firewalls, and more sophisticated intrusion detection. Yet, time and again, the most significant security breaches don’t come from technical failures but from something far more difficult to patch: human behavior.

The Signal Incident: A Case Study in Human Error

The Trump administration recently provided a perfect example. Top officials, including Vice President JD Vance and Defense Secretary Pete Hegseth, used Signal—an encrypted messaging app widely considered highly secure—to discuss detailed plans for airstrikes against Yemen’s Houthi militants. Then, they accidentally added a journalist from The Atlantic to the chat.

These weren’t junior staff discussing lunch plans. These were high-ranking officials planning military operations using an app on their personal devices—compromising that information through a simple mistake. President Trump later acknowledged the issue, stating, “Generally speaking, I think we probably won’t be using it very much.” An understatement, to say the least.

Encryption ≠ Security

Signal was doing exactly what it was designed to do—providing end-to-end encryption that ensures messages are scrambled on one device and can only be unscrambled by the recipient. However, as this incident highlights, encryption alone does not equal security.

National security experts pointed out that discussing classified information on consumer apps is a major security breach, regardless of how secure the app is. Conversations about military operations should take place in Secure Compartmented Information Facilities (SCIFs), where cell phones are banned. The government’s secure communication tools have strict access controls, preventing unauthorized users from being added to conversations.

The Convenience vs. Security Tradeoff

Why would top officials bypass these secure systems in favor of a consumer app? The answer lies in a challenge familiar to every security professional: secure solutions are often less convenient. Government-approved communication tools are likely clunkier and more restrictive than sleek consumer apps like Signal. However, that inconvenience is often the price of true security.

Shadow IT: A Persistent Risk

The Signal incident highlights a broader problem in organizations: shadow IT. Employees often turn to unauthorized tools because official solutions feel cumbersome. This creates significant security vulnerabilities, regardless of how secure these shadow tools claim to be.

Building a Culture of Security

Technical solutions alone won’t fix human error. Organizations must:

  1. Make security personal—showing employees how breaches affect them directly.
  2. Design for human behavior—implementing user-friendly security measures.
  3. Train on real scenarios—using case studies and hands-on exercises.
  4. Make security visible—rewarding security-conscious behavior.
  5. Lead by example—ensuring executives follow security protocols.

At the end of the day, even the best encryption can’t protect against human mistakes. True security requires a cultural shift—one where individuals take personal responsibility for safeguarding sensitive information.

With two decades of experience helping organizations build security-focused cultures, John Sileo is passionate about empowering people to take ownership of data security, both personally and professionally. His approach bridges the gap between technical controls and human behavior to create security systems that actually work in the real world. Call 303.777.3222 or contact us to inquire about booking John for your next meeting or event.

Dear Daughter, Here’s Why I Can Crack Your Passcode (And How to Avoid Her Mistake)

There are two things I’ve learned from live-hacking an audience member’s smartphone during my keynotes:

1️⃣ Most of our passwords are terrible.
2️⃣ One simple change can make hacking your phone as hard as scoring Taylor Swift tickets.

The Sleepover That Changed Everything

I didn’t set out to become that dad—you know, the one who freaks out teenagers by hacking their phones at sleepovers. But one night, when my daughter and her friends were busy scrolling and texting, I pulled out a little party trick that I spent hundreds of hours developing: cracking one of their smartphone passcodes.

Cue the gasps. The wide eyes. The sudden clutching of phones like they were life support.

Why? Because I showed them in real-time that once I was in, I could do everything—bank as them, text as them, be them. And that hit different.

The same thing happens during my keynote when I “hack” an audience member’s smartphone. It’s one thing to hear about security threats; it’s another to feel how vulnerable you really are. But here’s the good news: fixing this is easier than you think.

Upgrade Your Passcode to a Passphrase

Instead of a weak four-digit PIN (which, let’s be honest, is probably your birth year backwards), switch to a passphrase—something longer, easy to remember, and way harder to crack.

Example:
 🚫 1234 → 10,000 possible combinations (AI can crack this in seconds)
 ✅ ! L0v3 D@d → Over 60 quadrillion combinations (Good luck, hackers!)

How to Set It Up

🔹 iPhone Users: Here’s how to create a stronger passcode
🔹 Android Users: Check with your phone manufacturer for instructions

And don’t forget: Make sure someone you trust knows your passphrase in case of an emergency—store it securely in your password manager so you don’t forget it either!

Bonus: Lock Down Your Online Accounts

Your phone’s passphrase is just the start. For online accounts, ditch passwords entirely and switch to passkeys—they’re easier and more secure. Check out our video on passkeys here.

Because keeping your data safe shouldn’t be harder than getting into a Taylor Swift concert. 😉

Sleep tight, and stay secure! 🔐

DOGE’s Disastrous Cybersecurity Slashes: An Open Bar for Nation-State Hackers

The Department of Government Efficiency (DOGE) has made a catastrophic decision—one that isn’t just political but a direct threat to national security. Without conducting a single interview, DOGE and the new administration fired hundreds of cybersecurity experts from key agencies, including:

  • The Department of Homeland Security (DHS)
  • The Cybersecurity and Infrastructure Security Agency (CISA)
  • The National Institute of Standards and Technology (NIST)
  • The National Science Foundation (NSF)

By gutting these critical roles, DOGE has rolled out the red carpet for cybercriminals, giving hackers from Russia, China, North Korea, Iran—and anyone with a laptop and bad intentions—free rein to attack America’s most sensitive systems.

DOGE is intoxicated with power it should not have, but it’s every American that is going to suffer the hangover.

A National Security Disaster

The agencies responsible for protecting Social Security benefits, tax returns, healthcare records, and even nuclear codes are now severely understaffed. This means:

  • Longer detection times – Breaches could go unnoticed for months or even years.
  • Weaker defenses – Cyberattacks will be harder to prevent and contain.
  • Increased financial and personal risk – Both individuals and businesses will be more vulnerable to cybercrime.

And this isn’t just hypothetical. China successfully hacked the U.S. Treasury Department, major telecom companies, and even former President Trump’s phone calls—for years—without being detected. That happened before these mass firings. Now? The situation is far worse.

Businesses Are in the Crosshairs Too

The private sector won’t be spared either. With fewer cybersecurity experts:

  • No coordinated threat-sharing – Attacks will spread unchecked between companies.
  • No elite response teams – Breaches will cause more damage and take longer to fix.
  • More ransomware attacks – Businesses will be forced to pay millions to cybercriminals.

Who exactly will stop the next Colonial Pipeline attack? The next United Health breach? The experts who saved those companies no longer work for the U.S. government.

What Can Be Done?

While DOGE continues its reckless power grab, Americans still have a voice. Here’s what can be done now:

If nothing is done, the next cyberattack won’t just be an inconvenience—it will be a full-scale crisis.

The warning signs are clear. The only question now is whether action will be taken before it’s too late.

If your organization needs help navigating the chaos, let’s talk!