Why Smart People Fall for Scams and How to Protect Yourself

**[00:00:00]** Hello everyone and welcome to the Web Talk Show. My name is Armando Perez-Carreno and today with us is Robert Siciliano from Protect Now. How are you Robert? I'm good Armando. Thank you so much. I am very excited to talk about today's subject. But before we dive into it, can you tell the audience a little bit about what you do at Protect Now and more specifically how you got into this So uh we provide true security awareness training and what that basically means is you know uh mitigating risk when it comes to violence and theft prevention in both the physical and virtual world. Um most security awareness training today or they call it security awareness training is really just fishing simulation training on a corporate level. It's like compliance-based, check the box, do this, don't do that, or else. And that's really not security awareness training. I provide like a holistic approach to, you know, these are the bad actors, this is how they choose their victims. And, you know, let's get into a dialogue as to how you, you know, mitigate that risk. Okay. I've been doing that now since the mid '9s. I got into this um when I was in my uh teens, actually, um victim of a violent crime. uh met young women who had been sexually assaulted and this was when I was a teenager and that all of that had a profound effect in the way I viewed the world and so I kind of migrated towards professions revolving around security. By the mid '9s I was teaching real estate agents personal protection because real estate agents in the US occasionally are murdered. you know, uh, it's a thing. Doesn't happen all that often, but when it does, it's pretty tragic, of course. And so, to manage my small business back in the day, I bought my first computer in 1995. And that was an IBM PS1 consultant, which was the making the model of a Windows 3.0 OS **[00:02:00]** machine with 150 megabyte hard drive. I had to buy an additional card to install in it so I can get dialup connection to AOL. Mhm. back in the day. And um to manage my small business, you know, that's why I had it. And also to accept credit cards because I was, you know, selling books and videos to the real estate agents. And I so I had merchant status over AOL dialup. And I got hacked in 1995. I laugh, but it wasn't funny then. I lost thousands of dollars. And as upset as I was um losing all that money, I wanted to understand how it happened because, you know, my business was and is personal security as it relates to violence and theft prevention. And I was just stolen from via AOL, via dialup. And I didn't even know that was a thing. And when I talked to my bank and credit card company, they're like, "Yeah, we're seeing that more and more now." And uh as I began to investigate it and understand it, I started to talk about it to my you know clients, my real estate agent clients and how this is going to be a problem as we, you know, evolve with the internet. And uh before you know it, yeah, I mean by the late 90s, early 2000s, we started to see data breaches all over the place. And I was already talking about these issues for years at that point. And here we are like 30 plus years later. And um I mean it's looking like a 122 something trillion dollar issue by 2031. Wow. Yeah. It's it's amazing to that it happened back then and that you weren't like a target Fortune 500 company that everyone just wants to hack. like you were a small business and still back then there **[00:04:00]** was that opportunity to be Which is troubling but makes you think vulnerable people are today. Yeah. Yeah. And you know and back then my process my uh methodology for providing security awareness training then and now is essentially reverse engineering the bad actors process their motivation how they choose their victims and what that looks like. You know kind of like getting on the inside of how they operate so that you can kind of understand all of that and how that affects you. And so once you understand the inner workings of their, you know, process, you can, you have a better chance of of reacting, responding when they actually choose you, right? Whether it's physical violence, you know, uh whether it's a, you know, physical assault, sexual assault, or your identity being stolen. And when you see all the inner workings, uh it makes a lot more sense to you, you know, versus like just seeing the outcome. when you see how it all works. Uh that's how I've always trained. And um you know what's interesting to me and you know is that in 30 years what has changed in 30 years is that the bad actors they're organized today. I mean they treat fraud as a business. They treat cyber crime as a business. This this is a for-profit operation where they have, you know, a hierarchy. They've got like a CEO, a COO, they've got supervisors and managers, they got frontline employees. It is a business. They work, you know, 9 to5 and around the clock all day, every day around the world. It is a business. Same structure as you know, say Dell or Microsoft, you know. Whereas **[00:06:00]** employees, everyday people don't treat fraud or security any different any differently today than we did 30 years ago. We're basically doing the same things. And when I say doing the same things, meaning like we're almost doing nothing to prevent it because we don't necessarily even want to believe that we we would ever even be chosen. Why would they steal my identity? Why would they break into my house? Like we kind of function in denial. We basically do next to zero. And we have all these amazing tools at our fingertips to manage that risk, but we we don't take advantage of hardly any of them. Wh you're saying this, what immediately comes to mind is people using passwords, but still writing the password on a sticky note and pasting it on the monitor. That's exactly it. Password managers are software tools that have been around for like 20some years. And right now, statistically, less than 10% of the general population is using a password manager. And I know this because I get in front of live audiences for a living and I ask every single audience I get in front of, how many of you can honestly say that you're using a different secure passcode across each of your critical accounts? In other words, never using the same passcode twice. How many of you? If I get 10% of the room to raise their hand, that's a lot. And in the same breath, how many of you are using a password manager and I'll get like maybe that 10% that just raised their hand because in order for you to have a different passcode across each of your critical accounts, you've got to have a password manager. You know, that's the best way to go about that. And um we're still not doing that one basic 101 absolutely necessary thing to manage the risk of access control. That I'm glad you said that because there's **[00:08:00]** there was another episode where we briefly touched on the subject of password managers and we chopped the video up into shorts and things, right? So one of the shorts was specifically talking about password manager and our guest was saying something about the password how important they are and somebody I remember somebody commented something like why are you saying so such a basic things everyone like like if everyone knows about a password manager and that they should use it and I'm like no most people don't know they exist let alone use them. Yeah. And that's 30 years later and we're still operating as if it's still dialup AOL when it comes to our information security. Two-factor authentication. I asked that same question. How many of you have two-factor authentication for all your critical accounts including both your work email and your personal email? If I get 15 maybe 20% of the room, that's still a lot, which means, you know, 80% aren't using two-factor authentication at least. So, they're not using two-factor authentication. They're not using a password manager. They're using the same passcode across multiple accounts. And the bad actors fully fully understand that. They know this. Like they're they're 100% on board. They do not want you to have a password manager. They do not want you changing up your passcodes. They want you using the same passcode across multiple accounts. They they they they are fully clued in to the fact that as consumers, as citizens, as employees, we do almost nothing. And that will likely be the case in perpetuity because humans have a significant aversion to security. Like we don't actually necessarily want we want the outcomes of security but we don't necessarily want more **[00:10:00]** security in our lives because security is one of those things that it sounds odd to people. It kind of goes against our core and what does that actually mean? So security is about understanding and thieves. It's about recognizing that there are sociopaths and psychopaths out there that mean to do me harm. Well, just the thought of that is kind of scary. Like I don't want a sociopath or a psychopath coming after me. I don't want to think about that. I don't want to acknowledge that to begin with. That's how we are as humans. Like we move away from pain and towards pleasure as humans, you know, and moving away from pain towards pleasure as a human when it comes to security is functioning in denial. It can't or won't happen to me. It's what we do. Denial is awesome. It really is. We need denial. But when it comes to security, it's does not serve you at all. But we truly don't want to think or believe these things are going to happen to us. Therefore, we ultimately do nothing. You know, and that process is kind of what I do and how I break it down for my audiences. Like when I get in front of a live audience, I'm asking all of these belief challenging questions, you know, and I asked them about the password managers and the two-factor authentication. And then I I I start asking like basic questions like okay so how many of you have a home security system and I might get 10% of the room to raise their hand and I say okay well did you know in the past you know year that on average we have like between 1.5 and 2 million burglaries. Did you know that? And they're like I I **[00:12:00]** had no idea. I go, "So, what that means is over the next 10 years, that's like between 15 and 20 million homes are burglarized in the next decade." They're like, "Whoa, I had no idea that that was the case." And I'm like, "Yeah." So, and I go, "So, but why don't you have that home security system?" So, what we're doing now is I'm engaging in a dialogue, which is what security awareness training should be. It should be a a communication between two or more people, not necessarily like a monologue where you're being told what to do, which is most security awareness training today. So, we engage in this dialogue and I'm asking like, why don't you have the home security system? And then the hands begin to fly up. Oh, we don't have a home security system because we have insurance. As if insurance is going to protect you at 3:00 a.m., you know, so kind of not well thought out, you know. And then I and then then the hands go up. Well, we don't have a home security system because my husband says if they're going to break in, they're going to break in. There's not much we can do to prevent it. Which I say, well, your husband is using to justify his lack of investing in his family's safety and security. I'd start thinking about a divorce. And I get laughs from everybody but her, you know, and then I say, "Okay, so why else don't you have the home security system?" And then somebody raises their hand and says, "I don't have a home security system because I don't want to live like that. I don't want to live in fear. I I trust people." And I'm like, "Yeah, I hear that all the time." And I go, "Okay, so based on what you just said, I'm going to ask all of you right now." And this is, you know, our dialogue. I say, "Okay, so I'm a guy, and this is true, I'm a guy that actually has 20 plus security cameras, which, okay, maybe a little excessive, but I do, you know, between the outside and interior of my home, 20 plus security cameras." And I go, "So, **[00:14:00]** what does that say about me, about my disposition, about my outlook, my belief systems? Like, I wake up every day with 20 plus security cameras and I ask, I must be what? What do you think they Paranoid. a hundred people go paranoid and they laugh cuz it's kind of funny and they go, "Oh, we just called him paranoid, you know, and yeah, like they they they they equate investing in your security, managing risk, putting systems in place that you must be mentally ill because that's what paranoia is. It's a health mental health disease. It's a disease of the mind. It's the unjustified viewpoint that you're being persecuted by others and the aid the you know um medical communities will point that out. You know it's a psychosis but we equate in our culture security and paranoia in the same sentence. So why would you ever want more security in your life if it means you're going to live in fear? You're always going to worry. You're gonna have to look over your shoulder all the time. That's what we think. People would rather challenge security with fatalism. Oh, they can break in anyways. Why use a password manager if they can hack it? I'm not going to get a credit freeze. They can just hack the credit bureau. Or denial. Oh, they're not going to choose me anyways. I call it the the the trinity of vulnerability. PDF, you know, PDF. paranoia, denial, and fatalism. That's what I'm up against. That's what consumers are up against. That's what a chief information security officer is up against when he's trying to train his employees on managing risk by providing them with security awareness training. That is clicking a link in in a fishing **[00:16:00]** Which isn't the whole picture at all. So when you engage in this dialogue, when you challenge their belief systems, when you point out the absurdity of our current culture when it comes to what security actually is, which is managing managing risk versus what it isn't, which is paranoia, and how fatalism and denial contribute to our lack of embracing security, then all of a sudden, like you have an audience of 100 people that are go like, "Oh, whoa, wait a minute. I didn't know that that's what security actually truly is. I want more security in my life. This is good. And then, you know, now all of a sudden, like the dialogue really changes pretty quickly because people got questions. They've had questions all their lives and they've never had an opportunity to ask because they've never actually sat in front of an expert that, you know, truly wants to engage in that discussion. even though their chief information security officer is probably the smartest guy in the company when it comes to all this stuff, but he or she just never made him or herself available because, you know, they never thought to do so. Or at least that's not what current security culture is about. Security current security culture is about do this, don't do that, or else. And it's about shaming the employee into I think one of the items you talked about right now is very important to lean on which is it's not in many cases more than peace of mind because you might have 20 depends on the size of the property, the spaces, the dark area, whatever. **[00:18:00]** You may have 1 2 3 4 whatever number it is. But the only thing it's creating well I think it's two things. One is friction. I was just listening to a couple of people talking about friction yesterday which is which is very very interesting word because friction by having a security camera by having an alarm system by knowing martial arts whatever friction means that the thief the burglar etc will look at one place and another place. If one has friction, they will avoid it and go with the one that has less friction. So I think that's something that we all need to think about. And second if I have a security camera and I hear a noise at night that I don't recognize, I can very quickly stay calm because none of my triggers said anything, which means it was probably the wall making an old house noise or whatever, right? If I hear a person detected message, then I know now I should be worried. Or you can simply just check if you're curious, if you didn't know if you left the door open, you can just check on your device and know that everything's fine. So, it's just an extra layer of peace of mind versus being uncomfortable, nervous because you don't know what what is actually happening. Yeah. That friction means you become a tougher target. you're putting systems in place to manage that risk so that when they actually are seeking their next victim and they see you have all these various systems in place that are making it very difficult for me as a criminal actor to do my job. I'm going to find somebody else that's basically doing next to nothing and I'm going to choose them. There always has been, there is, and there always will be this criminal element out there seeking their next target. And all we need to **[00:20:00]** do is become that tougher target. And I tell my audiences all day, every day that I can make you into the top 10% of secure persons. And how do I do that? By adopting the absolute basic tools. Because 90% of the general public isn't using a password manager. They're using the same passcode across multiple accounts. and they're not using two-factor authentication and 90% of them generally aren't installing a home security system or heck many of them aren't even locking their doors. So, you do these basic things, you're a tougher target. They're going to move on to somebody else. You mentioned earlier about security awareness training even from the beginning for real estate professionals for example which I expect some of it is also in the physical world and I think this can help people relate to the exercise versus sometimes computers can be very difficult to understand for people who are not completely computer savvy. So, I think just talking about it in the physical world, someone who might be walking down the street on their phone without noticing their environment might be a better target than someone who is actually aware of their surroundings and is looking for for ways to stay safe when they're out and about and they might know how to defend themselves to a certain point. Like do you touch on any of that when when you're talking to people to help them understand? Like it's it's it's very different to to attack someone that's obviously not even aware of where they are because they're on their phone versus somebody that might be a little more prepared. Of of course like that that that's exactly what I do. So my philosophy is and has always been because I've been doing this for 30 years. When there was no true internet, there was AOL, **[00:22:00]** right? And my philosophy is and has always been that all security is personal security. At its core, true security awareness training isn't about IT policies or corporate compliance. It's about violence and theft prevention. Right? In the physical world, security is a personal survival. You know, it's knowing how to react and respond to real world predators and thieves. Uh setting up a home security system, practicing situational awareness, using physical self-defense to protect yourself and your family. And from that foundational layer of self-preservation, digital security is simply the modern evolution of the exact same instinct, you know, and that's protecting your identity and your bank accounts, managing your passphrases, reacting to calls, emails, and phone calls the same way you would to anybody physically trying to harm or hurt you in the physical world. And what I've devised essentially over the past 30 plus years is a methodology an understanding of risk in such a way where when people can equate their physical self with their virtual self in regards to their security then they become what I call a strategic human firewall. So what is that? Well, uh, traditional firewalls as we know, you know, filter internet traffic. Human firewalls filter intent and block deception, right? So, what is a strategic human firewall? In both the physical and virtual world, it's really just situational awareness, which you mentioned, right? Situational awareness is understanding the perimeter around your body. It's knowing what's going on to the right, to the left, knowing what's going on behind you, and certainly what's happening out in front of you, you know, 50 to 100 feet around the perimeter of **[00:24:00]** your body. And if something doesn't look right, doesn't seem right, doesn't add up, our job is to react and respond to that in such a way where we seek a safe space. And it's the same exact thing with every phone call, email, text message, popup, Zoom call. Is that person I'm communicating with real? Is it a deep fake? Is it AI face overlay? Is that phone call coming from my actual, you know, family member or CEO? Or is it a voice clone? And so on, right? And so as we develop this strategic human firewall, we are adopting a permanent governance, a mindset that shifts from by default, I trust what I see because I'm human and I possess what I call the human blind spot, which is our default to trust to I verify everything. And while you know those technical firewalls block viruses, the strategic human firewall is designed to block deception. So that when the phone rings, you get the email, you get the text message, you are seeking out the flaw or the vulnerability or the motivation of the bad actor on the other end so that you become a human sensor network essentially managing risk in real time. Wow. I really like that because for me back many years ago I read Kevin Midnik's The Art of Deception and I found it to be a very refreshing though frightening exercise of understanding how bad actors did social engineering even back in the day. This was before the internet even. and how they would get access to huge amounts of money and were able to do activities without having a weapon, without harming anyone, just simply by calling different people and and gathering little bits and pieces **[00:26:00]** of information so that they could reach other people and and do whatever they needed to do. And so that for me was eye opening and I found those examples to allow me to take a step back and be like, "Oh, okay. So, this can happen. It's not just this thing that people are talking about security, right? It's like it's for real has been happening forever and and people are doing it very wellcraftrafted. They're they're they're good at it uh unfortunately and and much better prepared than the victim. Do you find that giving people anecdotes or or stories about things that have happened and how they happened helps them understand or comprehend this point more than than like what you mentioned before just scaring them into clicking things etc. 100%. People learn from stories. They take those stories that you provide them and they create uh moving pictures in their mind and as you are articulately they say that you know good stories only happen to people who can tell them and uh I tell good stories and when you are engaged in this dialogue of storytelling that revolves around experience other people's experiences and you articulately in dram dramatically tell those stories in such a way where it paints a picture that affects the person's emotions, it ultimately affects their disposition and and and if you present that information in such a way where it affects them where they appreciate it and the information and it touches them emotionally. Well, I've always understood that if you want to change **[00:28:00]** minds, you have to first change hearts, right? And so when you come from the perspective of appreciation and security appreciation, then you're providing a whole another level of awareness. It's not just aware of the issues and what the solutions are. You're providing security appreciation in such a way where I understand the issues and the solutions. But because I appreciate the value these tools have in my life and I care about the people in my life who I want to protect, therefore I really truly want and am going to do something about it. And security appreciation results in what we call the kitchen table effect. And the kitchen table effect is when you take the training from work uh and you bring it home to your family and talk about it around the kitchen table. That's when you actually cement those lessons for life. And when you make it personal to the learner, to the user about them, you know, we are a selfish or self-interested creature that needs to engage in self-care in order to survive. I mean truly um that's when the learner is really like taking it all in because you're making it about them and that's what it's supposed to be. That's what security awareness is supposed to be. But it's not today. It's it's it's do this, don't do that or else. It's it's fishing simulation training. And the way I explain this so simply is that like for um when I say all security is personal, I'll ask you, you're on an airplane and the flight attendant is providing you with the safety instructions and he or she says when the oxygen mask comes down, right? What are you supposed to do with that oxygen mask first? **[00:30:00]** You're supposed to pull it down. Put it on your face and put the strap behind your face. Put it on you first. Yeah. Exactly. Right. Put it on yourself first. And why why are you supposed to put the oxygen mask on yourself first? Why is that? Because if you try to help someone else and you run out of oxygen, then nobody gets the oxygen. Yeah. I mean, it just becomes this vicious circle of nobody's breathing, you know? So truly, if you want to survive, you got to put the oxygen mask on yourself first. And that's with all forms of security. An employee is not going to be invested in protecting proprietary corporate data until they know how to protect their child's digital footprint, until they know how to protect their own identity, until they know how to protect their own finances. like they need to be vested in security in themselves first in order for them to even care or why it is that they should protect the company information. And so when you come to security awareness training with the perspective that all security is personal, well yeah, duh. And then from there, you have a much more secure employee who actually recognizes his risk much more effectively, personally, and then professionally. Wow, that's a great way to put it. So, if someone's better prepared for security or is more security aware at home in in his or her personal life, they then become better at it at the workplace. They become a strategic human both personally and professionally. Yeah, I like that. Let's say I'm someone who does not really believe all this security stuff. I hear it and I'm like, "Yeah, **[00:32:00]** I mean, whatever, right? Um, I'm very smart and I won't get scammed by anyone." What are some ways that bad actors can fool someone who's very smart into giving out incorrect information or trusting that it's actually a loved one that's calling when they're really not? What What sorts of things do they do to sort of go through the cracks? They utilize a tactic a tactic called manufactured urgency. So I would say in 99 out of a 100red frauds that we see today, manufactured urgency is the default. So, if you look like back in the days of emails when they used lots of scammer grammar and so forth that you know if you don't log in and access your bank account right now, plug in your username and your passcode that you're going to lose access to your account or you might get an email or a text message from the IRS that says if you don't react and respond and click this link then you know we're going to send out an arrest a warrant for your arrest because you didn't pay your taxes. Or you might get a notification from the Registry of Motor Vehicles that says, "On our cameras, we caught you speeding and your driver's licenses is about to be suspended. Click this link to pay your fine via Bitcoin." Like, those are all forms of manufactured Do this right now or else, right? And that works. And what that does is it it causes a level of cognitive tunneling and all we see is the issue at hand, the problem that needs to be solved or else that's that's **[00:34:00]** how we react to things. That's that's a human trait that we do. And so if you hear say your loved one on a phone call screaming, "Mom, mom, I need help. Please just listen to this man. Just do what he says. Just do what he says." And it is literally your daughter's voice that you hear. Well, you're going to do everything that man tells you to do without even questioning whether it's real or fake because you just heard your daughter's voice. It's your daughter's voice. It's AI voice cloning. But it's your daughter's voice, which is perfect because the technology is perfect. That said, that cognitive tunneling kicks in. You're just going to do what they say for the next 5 hours because you don't have any other ability to do anything other than what they say because your entire body is about saving your loved one from harm. And that is awful. And it's kind of awesome at the same time. It's like, wow, that's awesome that they can do that, that they do do that, that we are so susceptible to that. M and when you understand all of that and you reverse engineer the process and how it all works and how that cognitive tunneling is ultimately like what like wins every single time. And we do an even deeper dive on that process and ultimately how the manufactured urgency is used and weaponized. Part of this process is we expose what I call and this is really important because like all fraud boils down to one word and it's called trust. What is that? Okay. when it comes to security and our vulnerabilities over 30 plus years I've essentially come up with a methodology and an understanding that everybody should truly understand right here and now is that every single one of us listening to this call watching this video today have **[00:36:00]** what I call is the human blind spot which I mentioned briefly the human blind spot is the psychological instinct to trust it's the biological instinct to trust it's that cognitive gap where bi Biological trust overrides our suspicions, leaving the door wide open for all kinds of fraud and deception. Think of it like this. Human beings by default are um an interdependent species. Meaning like as an interdependent species, we depend on each other truly for our survival. Right? Uh at its at at its basics, man needs woman. Woman needs man to survive, to procreate, to further the species, right? And the basis of this procreation in order to get together, so to speak, we got to trust each other. If man didn't trust woman at all, and woman didn't trust man at all, they would never get together. They wouldn't have babies. Right. I mean, right. Mhm. And so as a result by default humans DNA is to trust each other. And earlier when we talked about security goes against our core beliefs predators and thieves and sociopaths and they are a very small percentage of the world's population. Actually when I say small about 2 to 3% of the world's population would be considered sociopaths and psychopaths. Hardcore narcissists. the ones that do the actual harm. Whereas 97% of us are worthy of trust truly. Okay? And so we trust most people because you know they're worthy of our trust. And throughout our lives, we trust pretty much most situations we're in. People that we correspond with virtually, people that are in our presence. We want to and believe that people are generally good and they generally are. that 3% still makes a lot of noise and **[00:38:00]** they weaponize our default to trust. They understand this about us and they use it against us. So that voice clone that that urgent message, they know that as long as there's a grain of truth to their story that our DNA wants to believe it. And because they have perfected weaponizing our human blind spot, our default to trust, we're looking at billions and billions to trillions of dollars in the years to come in losses. Why? Because most of us don't even understand our own human blind spot. And we say, "Well, I would never fall for scams. I'm too smart." I have heard thousands of times because I've dealt with thousands of victims. I I can't believe how stupid I was. I knew something was wrong right before it happened. And I say, well, knowing that there was something wrong right before it happened is your instincts telling you something's not right with the manufactured urgency. Whatever was going on, you sense something was wrong, but you didn't even want to believe your own instincts because of your human blind spot. You want to believe. It's not that you're stupid. It's that you're human. Humans don't fall for scams because they weren't paying attention. Humans fall for scams because they were paying attention to what the criminal wanted them to pay attention to. Just like magic. It's exactly like magic. That's exactly what it is. And magic is nothing but a lie. That's all it is. It's just the truth. And the truth is, well, I just did something that you just don't understand. And I just lied to you. **[00:40:00]** But the truth is this. Oh, okay. And then if they reveal the scam, well, that's the truth behind this scam or the magic. It's not magic. There's no such thing as magic. It's just a show. It's direction, right? It's using that same element that you're talking about and pointing people here where really the action is happening here and that's the show. But used incorrectly or from a bad actor's point of view, then it's something else Yeah. And we as humans love magic. We love, you know, the show and we accept that to a degree as truth due to the fact that we actually pay to go see it. But in the end, you know, it's just a slight of hand. It's just misdirection. It's just cognitive tunneling. And in the end, that process, that strategy is exactly what's being used to manipulate everyday humans into forking over their credentials, their money, wiring funds, deception, magic is deception, fraud is deception. It's all the same thing. It's just a lie. Um, human beings by default want to believe the lie. And as long as we continue to do this, believe the lie without questioning it, as long as current security awareness training is inadequate in explaining that process, it's going to continue to be a problem. I am a one of the lone voices that actually expressed this in this manner and therefore, you know, I'm one of many that um, you know, isn't being effectively heard. What I've seen to put it in perspective from all the people that I've exchanged conversations with that **[00:42:00]** have been in a situation of a scam or fraud. None of have been victims of a hacking attack. It's always been that they were misguided into handing over their credentials into handing over their two-factor code into saying the wrong thing, right? And so if you look at the amount of cases that happen and yes, of course, especially now with with AI and and the speed at which they can perform these attacks at at mass at scale. Yes, there if there's a password breach and a lot of accounts get exposed then yeah they can attack a lot of things but most of the important things are starting more and more to force two factor authentication. So while that is happening, I think the bigger situations are the ones where, like you said, people are misdirected into actually handing over the keys to the kingdom, if you will. And that's that's where the big issue Human manipulation, hacking humans. In whatever study you might look at, it's as much as 3/4 of of all breaches are a result of human error. Either a mistake they made and or them being manipulated, them clicking a link where they shouldn't have. It is truly hacking humans in manipulating humans trust. That is where the true liabilities are. um until we make the employee part of the solution versus like part of the you you're the reason why we have these breaches uh as the problem you know we make them part of the solution again they become part of that human sensor **[00:44:00]** network and that's the that should be the goal but the goal for most you know CIOS CTO's CISOs is the metrics that they get when it comes to the fishing simulation training and these are how many people engage page and these are the click rates and how many people didn't click versus how many people did click. And in the end, you know, as long as their metrics are good, then everybody generally passed the test, then they get their budget for whatever. And that compliance training is necessary. It's required, but that doesn't necessarily mean it's solving the problem. What it's truly doing is it's, you know, uh security fatigue. And security fatigue is caused by that compliance trap. And ultimately what we're seeing is we're bombarding employees with complex impersonal rules that ultimately trigger that security aversion. And it's that false sense of security felt by meeting those regulatory requirements while the actual human behavior remains unchanged and vulnerable. And while fishing simulation training is still necessary and it's designed to fix the problem of fishing, it still fails to um address the human where they're at and it fundamentally doesn't, you know, change behavior or make the employee care about security, which is should be the goal. And what times what sometimes happens as a result is when the employee, you know, clicks the link and gets in trouble, we blame and often shame that victim into compliance. And it's that silent failure that I talk about, which is a compromise of that human that triggers no technical alarms and it goes unreported, right? what they did. They don't tell anybody because of that shame, you know, and that shame is the emotional wall that prevents those victims from reporting **[00:46:00]** what happened to them. And we can break that shame barrier by treating those mistakes as data, not causes for termination. You know, I I I look at statistics all the time that are generated by the government in regards to, you know, dollar losses and how many victims reported and it's and often, you know, you can you can easily say that like let's just say, you know, there was a hundred people that reported this particular crime and these particular losses. In reality, there was probably 400. Like maybe 25% of them actually reported it. And it's like threearters generally don't. And why don't they? Shame. Yeah. They don't want to admit it. They don't want to admit that they got scammed. I thought I was so much And that's like a big problem. And um it's in a corporate setting equally. You know, it's it's everybody. It's it's it's it's natural and it's normal. It goes back to high school. I mean, it goes back to being a kid. And all of that when it comes to security awareness training needs to be talked about and we just don't do that but we should and we can make some significant inroads and actually engage in security appreciation which is truly ultimately the shift from awareness which is basically knowing I know I know what to do to appreciation which is caring like we talked about. And when employees appreciate how security protects their own lives, you know, all security is personal, then ultimately that's when behavior changes permanently. You know, this is the security appreciation gap. It's a chasm between an employes's intellectual understanding of risk, which is just, you know, awareness, basic awareness, and the emotional commitment to act on that knowledge, which truly is appreciation. And again, you know, that's where we get that kitchen table effect and **[00:48:00]** that's when the employee teaches those concepts to their family, cementing those lessons for life. And that is truly and should be the goal. And here we are like this is cyber security awareness month. Mhm. Which I've never been a fan of, you know, celebrating months like that. I just think it should be every day. One of the semi-reent I mean a few months ago attacks that happened was the Axios attack. It's an npm pack for those who are develop software. You can use packages from third parties in your in your systems. And this is a very well-known wellused not so much anymore but still a lot of softwares use it. um it's it's a networking um part of the stack and so people would install it but all the LLMs that are coding now would install it as well similar to how they install a lot of software and so just in a nutshell what happened was that one of the maintainers of this open source project was social engineered into well gaining access to their machine and then whatever happened they were able to modify a package it went up and then thousands of people downloaded the compromised package right and so this was a big deal because nobody even knew what happened because all the LLMs were installing the package so you don't know what's actually happening and this opened up a whole new exploration of like how do we prevent that sort of thing but I think the reason I bring this up is what you're saying makes a lot of sense is because if you look at this particular attack where they got into this person's machine, well, yeah, they wanted to get in because they wanted to exploit their access to this open- source repository and attack other people, right? But at the same time, like if you look at as a human, that means they got into his computer, which might hold **[00:50:00]** his family information and things about his kids and his wife. Like if you think about it that way, like it's not only the the what you're doing for work or for for the software community, but it's also now affect it's in your network. And so if you if you're not thinking about your personal security as you very well explained throughout this conversation like it's this is a great way to think about it. Even if it's some workrelated, it can come home. So if you bring it home as a conversation, I think it's a great thing because now it's something where it it just goes all around everything you do, home, work, virtual world or or I couldn't have said it better myself. So I have always equated, look at if you've ever studied, you know, uh Abraham Mauslo's hierarchy of human needs, right? that triangle that he points out is like at the base of that triangle are our physiological needs. Physiological meaning like you know you got to get like you know 5 to eight hours of sleep every night. You got to consume fluids to hydrate. You got to consume food for nourishment to you know live another day. Why? To procreate right? And then right above that is our safety and security needs which are basically safety, security, stability, structure and protection. So physiological safety and security and above that is like you know love and belongingness, self-actualization, all that stuff, right? Mhm. And if you if you look at security like pretty much right at the base of that triangle, you know, uh and our physiological needs, like all of that is like physical health, mental health, you know, sustainability. I it's all wrapped up in in the same package. And we need to pay as much attention to our security as we **[00:52:00]** do to preparing a healthy meal, as we do to maintaining a healthy mindset, as we do to maintaining good, healthy relationships with our spouses and our children. It's all the same stuff. If any of that is unattended to, if you're not paying attention to your physical health, if you're not paying attention to your mental health, if you're not paying attention to your general well-being or to your security for that matter, that lack of balance is going to metastasize into something that you did not see coming. Whether it's a physical illness, a bad relationship, or a significant security vulnerability. And I like, you know, I I don't think it's necessary to live that unbalanced when it comes to any of those things. It's just about making a little bit of effort in regards to anything and everything. You're married. You should be paying attention to your spouse's needs. You should be paying attention to your own well-being and your own mental health in order to be a better partner. You should be making sure that you're eating good foods and that your kids aren't consuming tons of sugar. Like, all of that matters. And it's just being thoughtful and conscious and mindful of all of life in general. Yeah, I couldn't agree more. What would you recommend to our listeners? They could be business owners, they could be employees, they could be retired, anyone that is listening to this episode. what would be your recommendation to start practicing a little more security awareness in their life or work? So the basic things like setting up two-factor authentication just Google Amazon two factor and enable it. Google you know eBay two factor and enable it. Google Gmail **[00:54:00]** two factor and enable it. Do those basic things so security becomes a frequent thing that you're engaged in. set up a password manager because now every single website that you visit on a regular basis, you're going to use that password manager as that de facto tool to manage access. You're going to use that password manager to set up long strong uppercase lowerase numbers and characters passwords that are never the same across two accounts. And now this becomes part of your daily habit, your routine. And so between changing of your passcode, using a password manager, using two-factor authentication, now digitally, you're thinking securely regularly, right? And then from there, freeze your credit. Like use a credit freeze to protect you from new account fraud so that your identity is properly protected. go to TransUnion, Equifax, Experium, and set up an account and freeze your credit, which still allows you full-blown access to all of your lines of credit. You can still get credit cards. Your credit cards still work. All you're doing is preventing a bad actor from taking your social and using it without your authorization. I've had criminal hackers email me my own social security number. Hey, security guy, here's your social. Haha. Basically flexing their muscles, showing me how cool they are. I could care less. I have a credit freeze. That said, you do those basic things. Before you know it, you know what else you're doing? You're locking your doors. Why? Because security makes sense to you now. It matters. It's not about paranoia. It's not about worry. It's not about fear. It's not about I don't want to live like that. It's about, you know what, 97% of the world's population is worthy of my trust. But like that guy said, 3% they're sociopaths and psychopaths and hardcore narcissists and their role on this planet is to **[00:56:00]** do harm. Therefore, like you know, as part of the 97%, I'm going to do what I believe is right to protect myself, all security is personal, and my loved ones because I love them and I want to make sure that they breathe easy. And so I'm going to be that much more effective at work, too. like it's like, you know, just one foot in front of the other, baby steps. This has been amazing advice, Robert. Thank you so much for sharing all your knowledge with us today. And thank you for coming on the show. Anyone who's listening, if you haven't liked and subscribed, please make sure you do so so that you're aware whenever we release new episodes like this amazing one with Robert Today. And make sure to find Robert as well in Protect Now. How can you they find you, Robert? Is the website, YouTube, LinkedIn, what what's the best place to find more information about you and what you're doing at Protect Now? First, uh thank you so much for uh your generosity with this podcast. You have done a excellent job of unpacking this information. So, thank you for that. Um I'm on, you know, all the socials like everybody else. uh LinkedIn uh Robert Siciliano on LinkedIn. I give this information away every couple of weeks on my newsletter. I have tens of thousands of people following me. So find my LinkedIn newsletter. Just search Roberts Siciliano and connect with me and otherwise my website is Again, that's protectlc.com. Amazing. It has been a true pleasure. I'll put all that in the show notes as well and I look forward to talking soon again. Thanks everyone and we'll see you in the next one.