Practical guidance on compliance,
security awareness, and training.
Straightforward articles on regulatory frameworks, risk management, and how to satisfy training requirements, without the jargon. Written by the team that builds the platform. No guest posts, no fluff. Train. Track. Prove. Stay Prepared.
All articles
Sorted by date
Security Awareness Training for New Hires: What to Include in Onboarding
Onboarding training is a different task from the annual refresher. What to assign before a new employee gets system access, how to sequence it, and the records that answer an auditor, a client or an insurer.
7 min read
Business Email Compromise Training: What Employees Need to Know
What employees need to know about business email compromise: common variants, red flags, verification steps, reporting, and how to document the training.
12 min read
ABA Data Security Obligations: What Law Firms Must Do
What the ABA confidentiality duty means for law firm data security, where employee training fits, and how to document it when a client or insurer asks.
7 min read
AI Security Awareness Training: What It Should Cover
What AI security awareness training should teach employees about chatbot use, AI-generated phishing and deepfakes, and how to document completion.
8 min read
Choosing the right AML training partner: Introducing our AML training program
Anti-money laundering compliance is getting stricter, and the cost of getting it wrong keeps climbing. Here is how to pick the right AML training partner, who our AML training is for, and where to find it.
6 min read
How to build a cybersecurity awareness program from scratch
A plain-English, step-by-step guide to standing up a security awareness program, from defining scope and picking topics to running simulations, building documentation, and measuring whether it is actually working.
10 min read
Does Security Awareness Training Reduce Security Incidents?
The evidence on whether security awareness training reduces security incidents (phishing, breaches, and fraud) and what research from Verizon, IBM, and peer-reviewed studies actually shows.
10 min read
Global AI regulation in 2026: Convergence, divergence, and the literacy requirement every country shares
By 2026, AI regulation had gone global, with the EU AI Act, a wave of US state laws, and national rules all taking shape at once. The one near-universal thread was a requirement that people be trained to understand AI. Here is what converged, what diverged, and what it means for your program.
7 min read
AI regulation went local: What the wave of US state AI laws in 2026 means for governance and literacy
With no federal AI law, US states filled the gap in 2026, passing a wave of rules on high-risk AI, transparency, and accountability, many with explicit training obligations. Here is what the patchwork looks like and how to keep a program compliant across borders.
6 min read
How to Choose Online Cybersecurity Training for Your Team
What online cybersecurity training covers, what separates an organized training program from a checkbox, and how to match a program to HIPAA, SOC 2 and PCI DSS needs.
7 min read
What Is Controlled Unclassified Information (CUI)?
Learn what Controlled Unclassified Information (CUI) is, how it differs from classified data, and what your team must do to handle and protect it.
6 min read
SOC 2 Security Awareness Training Requirements: What Auditors Expect
Does SOC 2 require security awareness training? Learn what SOC 2 auditors expect, what your training must cover, and how to document it.
6 min read
Cyber insurance in 2026: The hard market finally ended, and AI coverage became something you could actually buy
By 2026, the cyber insurance market had found its new normal. Pricing stabilized, capacity returned, and carriers that once excluded AI risks began writing explicit coverage for them. Here is what changed and what it meant for policyholders.
7 min read
The EU AI Act's high-risk obligations are here: What they mean for AI literacy and accountability
In August 2026, the EU AI Act's rules for high-risk systems took full effect, including an explicit requirement for AI literacy among staff. Here is who is affected, what the act requires, and why training is now a compliance obligation.
7 min read
Cyber insurance in 2026: AI-driven risk and systemic exposure became the next underwriting frontier
By 2026, the cyber insurance conversation had moved past ransomware pricing to a harder question: how do you underwrite AI-driven losses and systemic, correlated exposure? Here is how carriers were adapting, and what it meant for policyholders.
7 min read
AI agents are now doing real work: What security awareness training needs to cover in 2026
Autonomous AI agents that draft, send, and even approve on employees' behalf are reshaping the threat surface. Here is why the human factor still matters, and what training must teach as the line between human and machine action blurs.
7 min read
Deepfake executive fraud: When the face and voice on the call aren't real, training is the last line of defense
Attackers are now cloning executives in live video calls to authorize six- and seven-figure wire transfers. Multi-million-dollar losses show why verification by process, not by appearance, has to become a trained reflex in every finance team.
7 min read
Harvest now, decrypt later: Why the quantum clock started ticking for real in 2026
Attackers are already collecting encrypted data they cannot break yet, betting that future quantum computers will. As post-quantum migration picks up speed, here is what the threat means and where awareness fits in.
6 min read
The FTC's expanded Health Breach Notification Rule: What digital health companies had to know in 2025
The FTC's updated Health Breach Notification Rule extended breach-notification duties to health apps and other non-HIPAA entities, and it raised the bar on what reasonable security and a trained workforce look like. Here is what changed and who it caught off guard.
6 min read
GLBA Safeguards Rule enforcement in 2025: The training gap that kept showing up in consent orders
As FTC enforcement of the Safeguards Rule matured, a clear pattern emerged in 2025: consent orders repeatedly cited missing or undocumented employee training. Here is what the enforcement actions revealed and how to avoid the same findings.
6 min read
Who needs HIPAA security awareness training, and how often?
HIPAA's training requirement applies to every member of a covered entity's workforce. Here is who that includes, what the regulation actually says, and how to document compliance for an audit.
5 min read
Secure by Design: How CISA's software pledge reframed accountability in 2025
CISA's Secure by Design initiative argued that software vendors, not just their customers, bear responsibility for security. By 2025, the pledge had become a standard expectation. Here is what the shift meant and how it changed the conversation.
7 min read
NIST CSF 2.0's Govern function in practice: What 'governance' actually asks of leaders
Two years after the Govern function was introduced, organizations were still learning what it actually required. It turns out governance is less about policies and more about who is accountable. Here is what the function asks in practice.
6 min read
AI-driven insider risk: When the biggest data leak is an employee asking a chatbot for help
The fastest-growing insider threat in 2025 was not a malicious employee but a well-meaning one pasting sensitive data into an unapproved AI tool. Here is why shadow AI became the new insider risk, and how awareness training fits the fix.
7 min read
Cyber insurance in 2025: Small business coverage became easier to find and compare
After years of the cyber insurance market pricing small businesses out or ignoring them, 2025 saw real change. More carriers, clearer terms, and comparison tools made coverage more accessible. Here is what shifted and how training documentation helped.
6 min read
Security champions: Turning trained employees into a distributed security team
By 2025, the most effective security awareness programs had moved beyond annual training to build security champions, engaged employees embedded across teams. Here is what a champions program is and how it multiplies your security capacity.
6 min read
Cyber insurance in 2025: Why continuous assessment replaced the annual questionnaire
By 2025, the annual cyber insurance questionnaire felt like a relic. Carriers were moving toward continuous assessment, and that changed what it meant to keep your organization insurable all year round.
6 min read
NIS2 in effect: What the EU cybersecurity directive means for training and management accountability
The EU's NIS2 directive raised the bar on cybersecurity across essential and important entities, with explicit expectations for staff training and board-level oversight. Here is who is covered, what changed, and how to prepare.
7 min readState privacy laws hit the mainstream in 2024: Reasonable security and the training expectation
By 2024, a wave of comprehensive state privacy laws had taken effect, most carrying a 'reasonable security' requirement that regulators read to include workforce training. Here is what the laws actually require and how training fits.
6 min read
Cyber insurance in 2024: The application became a binding warranty, and misrepresentation got expensive
In 2024, the cyber insurance application quietly stopped being a questionnaire and became a legal warranty. A misstatement about MFA, backups, or training could void coverage after a claim. Here is what changed and how to answer safely.
7 min read
SEC materiality determinations in practice: How the four-day clock and testing changed disclosure in 2024
A year into the SEC's cybersecurity disclosure rules, public companies learned the hardest part was not the four-day deadline but the materiality judgment that starts the clock. Here is what 2024 revealed and how documented controls support the determination.
7 min read
The password is finally dying: What the passkey rollout in 2024 means for security awareness
After decades of warnings, 2024 was the year passkeys went mainstream. As the biggest tech platforms made passwordless sign-in the default, here is what the shift means for password training, and why the human factor still matters.
6 min read
Cyber insurance in 2024: Premiums finally stabilize, but the underwriting questions got harder
After years of sharp increases, cyber insurance pricing flattened in 2024. But the market's new normal came with tougher, more evidence-driven underwriting, and training documentation remained table stakes.
6 min read
MFA fatigue and push bombing: When the second factor becomes the weak link
Attackers realized that if they could not steal a password, they could wear the owner down until they approved a fraudulent login. Here is what MFA fatigue and push bombing look like, and how to train employees to resist them.
6 min read
Cyber insurance in 2024: Tabletop exercises and incident response testing became a renewal requirement
As the cyber insurance market stabilized, carriers shifted their attention from whether organizations had an incident response plan to whether it actually worked. Tabletop exercises and tested procedures became a renewal question. Here is what carriers wanted and how to demonstrate it.
6 min read
The FTC Safeguards Rule training requirement, explained
The updated Safeguards Rule requires security awareness training for all employees. We walk through what the rule says, who it covers, and what documentation examiners typically request.
7 min read
The xz backdoor and the new software supply chain reality
An attacker spent years quietly building trust in a widely used open source tool, then nearly shipped a backdoor into millions of systems. The xz compromise was a wake-up call for how we think about the software we all depend on.
7 min read
NIST CSF 2.0 is here: The finalized framework that made governance the center of cybersecurity
In February 2024, NIST released the finished Cybersecurity Framework 2.0, the first major update in a decade. The new Govern function moved governance from an afterthought to the hub of the whole framework. Here is what changed and why it matters.
7 min read
Ransomware-as-a-service: Why the 2024 threat landscape changed and how training fits the defense
Ransomware is no longer the work of elite hacking crews. Ransomware-as-a-service turned it into a business anyone can buy into, and the initial access still usually starts with a person. Here is what changed and why awareness training is a frontline control.
7 min read
DORA is coming: What Europe's operational resilience act means for ICT training
The EU's Digital Operational Resilience Act sets sweeping requirements for financial entities' ICT risk management, including staff training and awareness. Here is what DORA requires, who is in scope, and how to prepare before it applies.
7 min read
AI-generated phishing and deepfakes: The social engineering threat that arrived in 2023
Generative AI made convincing phishing emails, voice clones, and deepfakes cheap and accessible to anyone. Here is how the threat changed in 2023 and what security awareness training must now cover.
7 min read
Measuring what matters: How security awareness metrics matured in 2023
For years, the only metric most organizations tracked was completion rate, and it told them almost nothing. In 2023, programs finally moved toward measuring what actually matters: click rates, reporting rates, and behavior change. Here is how.
6 min read
CMMC 2.0: The DoD's streamlined cybersecurity standard and what it kept about training
The Department of Defense's revised CMMC 2.0 reduced levels from five to three and simplified the model, but it kept security awareness training firmly in the requirements. Here is what changed, what stayed, and what contractors need to do.
6 min read
QR code phishing (quishing): The attack that arrived with the return to offices and menus
QR codes became ubiquitous again in 2023, and attackers followed. Quishing uses a QR code to slip past email filters and lure employees to malicious sites. Here is how the attack works and why training had to catch up.
6 min read
The SEC cybersecurity disclosure rules: What they mean for training and incident response
The SEC's 2023 rules require public companies to disclose material cybersecurity incidents within four days. They also raise the bar on governance. Here is what the rules say and how documented security awareness training supports compliance.
6 min read
The OWASP Top 10 for LLM applications: A first security framework for the AI era
In 2023, OWASP published the first Top 10 for large language model applications, cataloging risks like prompt injection and training data poisoning. It gave security teams a framework for a technology that had outpaced their playbooks. Here is what it covers.
7 min read
NIST CSF 2.0: The draft update that put governance at the center of cybersecurity
In August 2023, NIST released the first full draft of its Cybersecurity Framework 2.0, adding a new Govern function and broadening the framework beyond critical infrastructure. Here is what changed and what it meant for training and accountability.
7 min read
Cyber insurance in 2023: Capacity slowly returned, but ransomware sub-limits kept tightening
After three brutal years, the cyber insurance market began to correct in 2023. Premiums eased, capacity trickled back, but carriers held the line on ransomware sub-limits and kept demanding proof of security controls.
6 min read
What cyber insurance carriers ask for at renewal, and how training documentation helps
Most cyber insurance applications now ask whether the organization conducts annual security awareness training. Here is what carriers typically request, how to prepare, and why documented training matters for your renewal.
5 min read
PCI DSS v4.0: What the training requirement means for your organization
PCI DSS v4.0 clarifies and expands the security awareness training requirement. We explain what changed from v3.2.1, which employees need training, and how to show compliance to your QSA.
6 min read
ISO 27001 and security awareness training: What Annex A actually requires
ISO 27001 certification is often pursued for customer assurance, but many organizations misunderstand what it asks of security awareness. Here is what the Annex A controls actually require and how auditors evaluate training.
6 min read
Business email compromise: The billion-dollar scam that refuses to go away
Business email compromise costs organizations more than any other cybercrime, and it has for years. Here is why the low-tech scam keeps working, and what security awareness training has to do about it.
6 min read
GDPR and staff training: The awareness obligation most organizations overlook
GDPR is best known for consent and the right to be forgotten, but Article 39 and the security principle carry a training obligation many organizations overlook. Here is what the regulation actually requires and how to satisfy it.
6 min read
Cyber insurance premiums kept climbing in 2022: How documented security training helps at renewal
Premium increases, tighter underwriting, and harder questions made 2022 another difficult year to buy cyber insurance. Here is what carriers wanted to see, and why documented security awareness training became a decisive factor at renewal.
6 min read
The shift to zero trust: Why hybrid work made the old perimeter obsolete
By 2022, hybrid work was permanent and the traditional network perimeter was gone. Zero trust moved from a buzzword to a practical architecture, and here is what the transition actually required from organizations.
7 min read
Why 2022 was finally the year password managers stopped being optional
Password reuse remained the root cause of countless breaches, and 2022 was when organizations stopped treating password managers as a nice-to-have. Here is why credential hygiene finally got serious.
6 min read
Phishing simulations and awareness training: Do you need both?
Organizations often treat phishing simulations and security awareness training as interchangeable. They are not. Here is how they complement each other, what frameworks expect, and when each is appropriate for your team.
5 min read
NYDFS Part 500: Training deadlines and documentation requirements
New York's cybersecurity regulation requires annual training for all covered employees. We break down the deadlines, what training must cover, and the documentation you need to retain in case of an examination.
5 min read
CISA's 'Shields Up' and the Russia-Ukraine conflict: Why every organization went on alert
As the Russia-Ukraine conflict escalated in early 2022, CISA urged organizations to adopt a heightened cybersecurity posture. Here is what 'Shields Up' meant and what it taught about preparedness.
6 min read
War exclusions in cyber insurance: What the Russia-Ukraine conflict changed for policyholders
In 2022, carriers raced to clarify whether cyberattacks tied to state conflict were covered. The war in Ukraine forced a long-overdue reckoning over war exclusions, attribution, and what cyber insurance actually protects.
6 min read
Log4Shell: The vulnerability that made software supply chain risk impossible to ignore
In December 2021, a flaw in a ubiquitous logging library exposed millions of systems. As organizations scrambled into 2022, Log4Shell became the wake-up call for a risk most had ignored.
7 min read
The HIPAA Safe Harbor Act: How recognized security practices became a legal shield
Signed in January 2021, the HIPAA Safe Harbor Act directed regulators to consider recognized security practices when assessing penalties. It turned documented security programs, including training, into a meaningful legal shield. Here is how it works.
6 min read
Virginia's Consumer Data Protection Act: State privacy law arrived in 2021
In March 2021, Virginia became the second state to pass a comprehensive privacy law, signaling that data protection was no longer a California-only concern. Here is what the CDPA requires and how reasonable security and training fit in.
6 min read
TSA security directives: How pipeline operators got a crash course in mandatory cybersecurity
After the Colonial Pipeline ransomware attack, TSA issued security directives that made cybersecurity measures mandatory for pipeline operators for the first time. They also forced a broader conversation about regulating critical infrastructure. Here is what happened.
6 min read
Return-to-office security: What changed while everyone was remote
As offices reopened in 2021, many organizations discovered the security model they left in 2020 no longer fit. Hybrid schedules, personal devices, and a year of unpatched systems created new risks that required a deliberate reset.
6 min read
Cyber insurance in 2021: Social engineering and BEC drove a new wave of claims
While ransomware dominated the headlines in 2021, social engineering and business email compromise quietly drove a growing share of cyber insurance losses. Here is why carriers started asking harder questions about the human layer.
6 min read
NIST, CIS, ISO, and the rest: How to navigate the framework landscape in 2021
By 2021, organizations faced a thicket of security frameworks, and many asked which one they actually needed. Here is how the major frameworks compare, how they overlap, and how to choose without boiling the ocean.
7 min read
Cyber insurance in 2021: Ransomware kept the market hard, and carriers started demanding proof
Ransomware claims kept climbing through 2021, pushing premiums higher and forcing carriers to ask for real evidence of security controls. Here is what changed and why documented training became a renewal necessity.
6 min read
CIS Controls v8: The framework update that put cloud and hybrid work front and center
In May 2021, the Center for Internet Security released CIS Controls v8, a major revision that reflected a workforce that had gone remote and cloud-first. Here is what changed and what it means for training.
6 min read
Making remote work permanent: Security policies that survived past the pandemic
By mid-2021, many organizations decided remote work was here to stay. That meant replacing emergency measures with durable security policies for a workforce that would never fully return to the office.
6 min read
Executive Order 14028: How one directive made zero trust and software supply chains national policy
In May 2021, after the SolarWinds breach, the White House issued a sweeping executive order that turned zero trust, MFA, and software bills of materials into federal requirements. Here is what it mandated and why it reshaped security programs everywhere.
7 min read
A practical guide to compliance training for small businesses
If you run a small or mid-size organization and were told you need annual security awareness training, this guide covers what to look for, how much it should cost, and how to avoid buying more than you need.
7 min read
Vaccine phishing: How scammers exploited vaccination rollouts in early 2021
As COVID-19 vaccines became available, attackers pivoted to fake vaccine appointment emails, fraudulent scheduling sites, and counterfeit proof-of-vaccination offers. Here is what organizations and employees needed to watch for.
5 min read
Phishing simulations went mainstream in 2020: Testing the human layer became a standard control
In 2020, phishing simulations moved from an optional add-on to a standard part of security awareness programs. Here is why testing the human layer finally got serious, and how to run simulations that actually change behavior.
6 min read
Cyber insurance in 2020: The ransomware sub-limit arrived, and the fine print got teeth
Beyond the premium increases, 2020 changed the terms inside cyber insurance policies. Ransomware sub-limits, coinsurance, and tighter exclusions shifted real costs onto policyholders. Here is what changed and how to read the fine print.
6 min read
MITRE ATT&CK in 2020: The framework that made adversary behavior a shared language
By 2020, MITRE ATT&CK had become the common vocabulary for describing how attackers actually operate. Here is what the framework is, how organizations used it, and where awareness training fits.
6 min read
NIST SP 800-207: How zero trust went from buzzword to federal blueprint in 2020
In August 2020, NIST published SP 800-207, the first authoritative definition of zero trust architecture. It turned a vendor buzzword into a concrete framework, and here is what the standard actually says and why it mattered.
7 min read
Why cyber insurance got harder to buy in 2020
Ransomware surged, claims spiked, and carriers tightened requirements. Organizations seeking cyber insurance renewal in 2020 faced new questions about MFA, backups, and documented security awareness training.
6 min read
Zoom security: What organizations learned the hard way in 2020
Video conferencing became essential overnight, but many organizations discovered the security gaps too late. Zoom bombing, uninvited guests, and exposed meetings taught painful lessons about securing virtual collaboration.
5 min read
COVID-19 phishing: How attackers exploited the pandemic in 2020
Cybercriminals adapted faster than most organizations in early 2020. Fake CDC alerts, fraudulent stimulus check emails, and counterfeit medical supply offers flooded inboxes. Here is what happened and how to train employees to recognize it.
5 min read
Securing remote work: A practical guide for the sudden shift to home offices
In 2020, millions of employees started working from home with little warning. Here is what organizations should have prioritized to keep data secure when the office perimeter disappeared overnight.
6 min read
SOC 2 and security awareness training: What auditors actually check
SOC 2 does not explicitly mandate annual training the way HIPAA or PCI DSS does, but CC2.2 and CC2.3 effectively require it. Here is how training documentation supports your SOC 2 report and what auditors typically review.
6 min read
The Gramm-Leach-Bliley Act Safeguards Rule: Why training is part of your written information security plan
The Safeguards Rule has required financial institutions to protect customer information since 2003, and a written information security plan sits at its core. Here is what the rule requires and where employee training fits.
6 min read
CMMC 1.0: The DoD made cybersecurity maturity a condition of doing business
In January 2020, the Department of Defense launched CMMC, a certification framework that made cybersecurity maturity a precondition for winning defense contracts. It also put security awareness training on the procurement map. Here is what it was and why it mattered.
7 min readPut it into practice
Reading is step one. Training is what keeps you compliant.
Turn these insights into action. Our role-based security training takes minutes to set up and gives every learner a verifiable certificate of completion.
Stay informed
Get new articles by email
We publish roughly twice a month on compliance, security, and training. No spam, no fluff, you can unsubscribe anytime.
Ready to get compliant?
Training that takes four minutes to set up and gives every learner a verifiable certificate of completion.
Reading about compliance is useful. Actually completing your annual training is what counts. Subscribe online, no sales calls, no custom quotes.