Monthly Archives: June 2026

Most cyberattacks do not start with a sophisticated intrusion. They start with a click on a personal email, a reused password, or a file uploaded to a familiar cloud service because the approved option felt slower.The Verizon Data Breach Investigations Report found that 68% of breaches involve the human element. Not a zero-day exploit. Not a brute-force attack on a hardened system. Human behavior, in the course of an ordinary working day.For businesses running cloud-based workflows across multiple devices, the personal and professional overlap is now the rule. Understanding where that overlap creates risk is no longer optional. It is a core part of modern security strategy.The Risk Sitting Outside Your Security StackPersonal web habits are not reckless behavior. They are normal behavior.Checking a personal inbox on a work laptop. Logging into a social account during a break. Saving a work password in a browser already loaded with personal accounts. Uploading

It’s a statistic that sends a shiver down the backs of SME owners, managers and employees.  According to the FBI’s 2025 Internet Crime Report, business email compromise (BEC) cost US businesses more than $3 billion last year.This makes it one of the most financially damaging cybercrimes on record. AI has made these attacks harder to detect. The question for AP teams is no longer whether they can identify suspicious requests. It is whether the processes around payments make fraud difficult regardless of how convincing it looks.Why AP Teams Are in the CrosshairsAccounts payable sits at the intersection of trust and timing. AP teams process invoices, manage supplier details, and execute payments, often under pressure to keep operations running smoothly. For attackers, that combination is ideal.Most successful fraud does not involve breaking into systems. The FBI’s Internet Crime Complaint Center (IC3)  has consistently found that BEC attacks rely on impersonation. This involves posing as a

You click a link, sign in, approve the MFA prompt, and get on with your day. Completely unaware that someone else just logged into your account at the same moment.That scenario surprises many businesses, particularly those that rely on multi-factor authentication (MFA) to protect cloud accounts. But this is exactly how Adversary-in-the-Middle (AiTM) phishing attacks work. Rather than stealing passwords for later use, these attacks silently hijack an already-authenticated session in real time.MFA remains a core control, and getting it implemented correctly is still a critical first step for any business. But AiTM attacks exploit something MFA was never designed to protect: the trusted session that exists after authentication has already completed.Phishing Has Moved Beyond PasswordsPhishing remains the most common starting point for account compromise, but the objective has changed. Traditional phishing collected usernames and passwords. Modern phishing is after something more immediately useful: the authenticated session itself.Security researchers have documented a significant