Security awareness training resources and blog

Everyone talks about human risk. Almost no one measures it.

TL;DR— Part 1 of a multi-part blog series on the data behind Fable’s Human Risk Report Vol. 2. Last week at RSAC, we heard no shortage…

The report: The art (and science) of behavior change in human risk

This is the second volume of Fable Security’s ongoing exploration into how organizations measure, understand, and reduce human risk by both encouraging healthy cyber behaviors and…

Employees see phishing lures, not IOCs.

TL;DR— The final post in this six-part blog series on must-ask questions when creating net-new awareness training. Whenever possible, Fable Security asks its clients, “Do you…

The Stryker-Handala incident: Should you send out an employee alert?

TL;DR— US medical device company Stryker experienced a cybersecurity incident on March 11, 2026, after the Iranian hacktivist group Handala allegedly wiped “data from over 200,000 systems, servers,…

Headline or habit? How to choose your next awareness training topic

TL;DR— Part five of six-part blog series on must-ask questions when creating net-new awareness training. When Fable Security clients request briefings covering specific attacks, we ask,…

Emerging threat: Permit lures victims with new invoice fraud scheme

TL;DR— The FBI warned about an active invoice fraud scheme in which attackers are: Scraping publicly available city and county permitting information, Impersonating local officials via emails from almost-official…

Get the goods

Everyone talks about human risk. Almost no one measures it.