Good morning, everybody, and good afternoon over there in Israel! We have [guest name] today with Cybeready. Without further ado, we’d love for you to introduce what your company does and the kind of services you provide. (00:40) Okay, cool. Hi, everybody. Cybeready is a company that offers a platform to train your employees to better avoid phishing attacks and other cybersecurity threats. With Cybeready, we train your employees on the dangers, what to do, what not to do, and how to avoid common pitfalls. (01:14) So, how did you get to where you are in your career? What led you down the path of cybersecurity? Cybersecurity is essential because it addresses where malicious actors are most active nowadays. No matter the size of your organization, cybersecurity should be a priority. It’s not just a scare tactic—it’s a genuine concern. Personally, I am currently the Head of Product at Cybeready. I got here from being a product manager, and before that, I was deeply involved in design and UX design. My passion for design and technology as a teenager steered me towards this field, and over the years, my desire to have a more significant impact on the products I work on led me to my current position. (01:48) Sounds like a fun gig, and it seems like you’re well-regarded over there! So, what are some common cybersecurity risks that companies should be aware of today? Cybersecurity risks come in many forms. There's phishing, which is what my company specializes in protecting against. But there are also backdoor attacks, classic hacker tactics like breaching mainframes, and physical attacks where people infiltrate facilities and offices. Social engineering can occur face-to-face, not just via email or SMS. (02:23) Wow, that's quite a range of threats. It’s important to be cautious at networking events and other in-person interactions. Attackers might aim to steal money directly, steal intellectual property, or compromise employees' systems and credentials. (03:01) It seems like often the most basic things lead to cybersecurity issues rather than elaborate hacker schemes. Is that accurate for phishing and smishing? Yes, that’s correct. Phishing and smishing are inexpensive and don’t require advanced hacking skills. Many attackers use services to mass email or text organizations. They might try to obtain credentials or multi-factor authentication codes, or even send malware. While these are rarer, they do happen. Generally, low-level attacks are more common and don't require high-tech skills. (03:33) What are some time-tested techniques that companies can adopt to mitigate cybersecurity threats? Traditional methods like lectures and all-hands meetings can be useful in theory, but practical measures work better. Running continuous phishing simulation campaigns helps employees recognize phishing attempts. Just-in-time training is also effective—if an employee falls for a phishing simulation, they receive immediate training on what to look out for, such as misspelled sender names or domain names, and urgency cues in messages. (04:49) In addition to simulations and just-in-time training, general awareness training is crucial. At Cybeready, we send periodic emails to employees with tips on defending themselves online and offline. (06:02) Phishing attempts often involve impersonating someone from within the company, like the CEO, and requesting urgent actions. Always take a moment to assess whether the urgency is legitimate. If something seems overly urgent, it's usually a red flag. Scammers often create a sense of urgency to force quick decisions. (07:05) I’d also suggest contacting the person being impersonated using a different channel to confirm the request. Attackers who are not tech-savvy might still use publicly available information to target you, making it crucial to verify requests before taking action. (08:05) It’s wise to double-check, especially with requests involving money or transfers. I recently encountered a ridiculous attempt where someone was asking for Apple gift cards. I immediately informed my friend that someone was trying to impersonate them. Phishing attempts often involve fake websites that look legitimate but are designed to steal your credentials. Always scrutinize URLs and be cautious of unsolicited requests. (08:32) Also, beware of scams on social media. Friends’ accounts can be hacked, and links sent might be attempts to trick you into revealing personal information. (08:58) "I can't get back into my account. Can you help me? Click this link." I've seen this type of message go viral. Obviously, I never clicked it, but you should never say never. These attackers try to make you think you're smarter than you are, so it's crucial to stay vigilant and assess everything that comes your way. Smart people can still fall for these types of scams, so it's important to scrutinize every request and make decisions carefully. (09:21) I often see messages like this from friends on Facebook, asking for urgent help with their accounts. It's a red flag if someone is pushing you to act quickly without any verification. Always take a moment to verify the request before taking any action. (09:49) So, tell us more about Cybeready and the programs you offer to your clients. How do you help them address their cybersecurity awareness? As mentioned, we focus on two main areas: phishing training and awareness training. For phishing, we run campaigns with hundreds of attack simulations. Most of these simulations are based on real attacks, and some are designed in anticipation of specific events, like the Olympics. We create these simulations to better prepare our customers and help them avoid falling for such scams. Soon, we will expand to include other channels, such as smishing. On the awareness side, we provide learning content. This includes "awareness bytes," which are short emails with generally three or four tips on various topics, such as fraud, vishing (voice phishing), or keeping your desk organized to prevent information leaks. We also offer a compliance tool where companies can set guidelines and policies that employees must follow. Employees review these policies annually and sign off on them. We’re planning to add more features, like quizzes. Additionally, we have a phishing reporting button that works with both Google and Microsoft. If you see a suspicious email, you can report it. If it’s one of our simulations, you'll get a congratulatory message. If not, it will be forwarded to your IT team for further review. (12:07) Do you integrate this reporting into a larger community of reports, like a crowdsourced reporting mechanism? Not exactly. We have an API that checks the links in advance. If the link is not from our simulation, we use this API to determine if it is malicious or unverified. The CISO receives a notification with our classification, but we keep all data in-house. We receive tens of thousands of reports every month from our customers’ employees. (12:46) I’ve seen platforms like CrowdStrike that use a sharing mechanism to report across all their client portfolios. Yes, our focus is primarily on training and learning, not physical protection. We don’t share data outside of our system, but we do collect a significant amount of data from our clients. (13:15) You mentioned that special events often attract hackers. What are some key events people should be particularly cautious about? There are many, such as the Olympics, the Super Bowl, the FIFA World Cup, Formula 1 races, and elections. Our services are global, so we consider events in various countries. Additionally, global crises like the COVID-19 pandemic and the Russian invasion of Ukraine have seen a lot of malicious activity. Scammers target not just those directly involved but also wider audiences. New product releases, such as the launch of a new iPhone, can also be targets for scams. (14:28) Fundraising scams are another concern. For example, during natural disasters, scammers may set up fake donation sites. Yes, scammers often use these events to exploit people's goodwill. Always be cautious of donations and verify the legitimacy of the organization before contributing. (14:54) There are many myths about cybersecurity. What are some common myths in cybersecurity training that we could address as true or false? One common myth is that the click rate needs to be close to zero and that click-through rate (CTR) is the most important metric in cybersecurity training. (15:23) This is a frequent question from our customers. They often see a dashboard showing their company’s click rate, which might start at 10-20%. They aim for a zero click rate, but this isn’t necessarily ideal. A zero click rate might indicate that the simulations are too easy, not that the organization is fully protected. A moderate click rate suggests that the simulations are effective and challenging. (15:58) You want to continually increase the difficulty of simulations. For example, you might introduce new types of attacks, like QR code attacks, where people scan codes that could link to malicious sites. Even advanced phishing attacks may include deceptive elements like a "report phishing" button that is actually a malicious link. It’s important to keep evolving and testing new methods to stay ahead. (17:01) Such as smishing. They're always improving their methods. Exactly. It’s cheap and easy to send hundreds of thousands of emails in just a few minutes. This is why we always have to stay vigilant. It’s such an easy mode of attack, and with AI, the situation is only going to get more out of control. AI can become conversational, answer you, and even establish some trust before sending a link. The possibilities are endless. (17:28) Is it true that mandatory training is effective? No, not necessarily. As I mentioned before, I've experienced in-person training where everyone gathers in a hall, and a speaker shows us emails from attackers. During these sessions, people often get distracted, thinking about lunch or other things. Such training isn’t very effective. It could be effective if it's short, if it coincides with other types of training, and if it doesn’t stay too basic. If the content can intrigue employees, it might be more effective. However, if this is the only training provided, it’s not sufficient. For instance, a friend who works at a major tech company shared that employees found ways to circumvent mandatory training videos. They clicked on the transcript option, scrolled to the bottom, and were marked as having completed the training. This illustrates that mandatory training alone might not be effective if it’s not engaging or well-structured. (19:05) It’s like getting the cliff notes or just skipping to the end of a book. If training is mandatory, there’s often little incentive for it to be engaging or high quality. There needs to be some incentive or interest for people to genuinely participate. The content should not be too burdensome, and ideally, people should want to engage with it. At Cybr, our content doesn’t only cover professional subjects but also includes personal safety tips for online activities like shopping. This way, the training offers personal value, which can enhance engagement. (20:03) Training is never really done, right? Is it something that continues over time, or do you just give new employees an introduction and then consider them good to go? Yes, that’s a big misconception. Some customers think that signing up for cybersecurity training for a year or two is sufficient. However, training needs to be continuous. Employee turnover means that new people need training, and threats are constantly evolving. We talked about QR codes, smishing, Microsoft Teams, vishing, and AI—all these threats change over time. If you don’t continuously train employees, you leave yourself vulnerable. (21:10) Is theoretical training good enough, or is there a better approach? Theoretical training alone is not enough. For example, we send awareness bites—short emails with tips. If these are the only type of training provided, they may not be effective because they might not engage the learner or connect with their experiences. Just listening to a professor in college could be somewhat effective, but actively taking notes can increase learning. In our phishing training simulations, we provide feedback if a user clicks on a simulated phishing attempt. If someone consistently avoids clicking, we can’t always tell if it’s because they’re good at spotting phishing or just ignoring emails. So, we occasionally send congratulatory messages with tips to help users understand what to look out for. Each simulation includes different tips and scenarios to keep the content varied and engaging. (22:13) There’s a saying: "If you hear, you forget; if you see, you remember; if you do, you understand." Hands-on training is key. Just like a product manager develops their skills through years of experience and adapting to different environments, the same applies to phishing simulations. It’s important to adapt and keep learning. (23:36) Is it true that it’s not only fools who get phished? Yes, it’s true. Even tech-savvy individuals can fall for phishing. I recently almost fell for one myself. After being promoted to head of product, I received a simulation email about office supplies. It seemed plausible given my new responsibilities, and even though I recognized it as a simulation, it nearly caught me off guard. People can be absent-minded or affected by changes in their context, like a new role or emotional state. Everyone, from CEOs to board members, is at risk. Attackers will find your vulnerabilities and exploit them with sophisticated methods. (25:18) The more important your role, especially if you have access to sensitive resources, the more you become a target. Attackers will craft attacks to exploit your specific vulnerabilities, making their methods more intricate and methodical. (25:56) Sometimes, attackers catch you off guard when you’re busy or distracted. It’s easy to click on a link when you're flustered. Scammers often play on people’s egos, especially in tech, making them believe they’re too smart to fall for scams. But anyone can be a target. (26:19) I was quite embarrassed when I nearly fell for a phishing attempt. It’s a cautionary tale that highlights the importance of staying humble and aware. Even though you might not fall for 90% of attacks, falling for just one can be damaging. So, don’t assume you’re immune—be vigilant because anyone can be targeted. (27:13) So, that’s how they get you. But I guess, what’s next for Cybr? What should we look forward to over the next five years? I know you mentioned there are a couple of features you’re excited about, but as the product guy, you can’t spill the beans on those. Well, we don’t plan that far ahead due to the dynamic nature of our business. However, we do have goals. Our goal is to provide best-in-class training, which I personally believe we already do. We need to stay vigilant because our competitors might try to copy our features. We aim to train employees across all types of companies and industries, not just office workers. There are employees in logistics, warehouses, and other roles who need training too. (27:44) We want to meet everyone where they are, treating them with respect and maintaining a positive approach to training. We don’t shame anyone who clicks on a phishing simulation because it doesn’t mean they’re a fool. It just means the attacker was smarter in that instance. Additionally, we plan to expand the channels for simulations beyond just email and text. We’ll adapt to ever-evolving threats. For instance, maybe the metaverse will become relevant at some point. Although it seemed to lose traction recently, technology is always advancing. (28:56) So, what’s one thing potential customers should know about Cybr and why should they choose you for their cybersecurity training needs? One simple reason is that we provide the best type of training. Our system is designed to be automatic. With a small setup and a single click, Cybr Ready takes over. You don’t have to create simulations yourself or manage them manually; our system works for you. You can enable it, click autopilot, and we handle the rest—training your employees as they join or leave the company across various channels. We also offer a comprehensive content library for added value. It’s all automatic, smart, and tailored to individual needs. (29:30) That sounds great. Everyone loves an easy button, especially for training. Exactly. We don’t require you to manage thousands of simulations individually. We prioritize quality over quantity and ease of use over granular control. (30:02) Where can people learn more about your company? You can visit our website at CyberReady.com (note the single “R”). You can also find us on Google and LinkedIn. We have friendly and knowledgeable people available to talk to. (30:36) I like how you’ve blended the name together—once you get it, you get it. Thanks again for coming on today. To recap, that’s CyberReady.com. We’ll include this in the show notes. Please check out Cybr Ready in the NachoNacho Marketplace, where we are offering 25% cash back for a limited time. Feel free to visit their website or the marketplace to learn more about their cybersecurity awareness training. (31:24) Thanks again for joining us today. It’s been a pleasure.