Positive Phish Testing, Cyber Literacy & Human-Centric Security - Craig Taylor | Ep 389

Ezekiel Iferia sits down with 30-year cybersecurity veteran, CISSP, and co-founder of CyberHoot, Craig Taylor, to discuss why conventional cybersecurity awareness programs fail, how punitive "gotcha" phishing simulations destroy employee trust, and how positive reinforcement changes human behavior in digital defense.   Having led enterprise security across web hosting, financial giants like JPMorgan Chase, and global manufacturing at Vistaprint—and now serving as a virtual CISO (vCISO) to more than 40 companies—Craig challenges outdated security practices. He breaks down why NIST revised its 90-day password change recommendations, how AI-generated spear phishing has rendered typo-hunting obsolete, why modern session token theft bypasses multi-factor authentication (MFA), and how gamified, open-book training transforms employees into proactive human firewalls.   In this episode, you’ll discover: The Shift from Technology to Human Firewalls: Why perimeter defenses and endpoint antivirus fail when social engineering bypasses corporate controls.   The Failure of "Gotcha" Phishing Tests: Why shaming employees with fake HR notices creates an adversarial IT culture and causes workers to shut down.   The Positive Reinforcement Method: Teaching phishing mechanics through gamified, open-book exercises (HootPhish) using belts, avatars, and anonymous leaderboards.   AI-Powered Threat Escalation: How large language models eliminate grammatical tells, craft culturally nuanced pretexting, and democratize sophisticated cybercrime.   Post-Authentication Session Token Theft: Understanding the mechanics of Adversary-in-the-Middle (AiTM) phishing and how attackers hijack active browser sessions.   Managing Security Across 40+ Companies: Common systemic vulnerabilities observed from the vCISO trenches across finance, tech, and manufacturing.   Course-Correcting the Industry: Moving away from the "Titanic" hubris of tech-only solutions toward multidisciplinary, psychology-backed cyber literacy.   Connect with Craig Taylor & CyberHoot: Official Website: https://cyberhoot.com   Free Lifetime Cyber Literacy for Individuals: https://cyberhoot.com/individuals   Business Inquiries & Demos: mailto:sales@cyberhoot.com   Businesses & MSP Registration: https://nest.cyberhoot.com/autopilot-...   CyberHoot Cybrary (1,000+ Plain-English Terms): https://cyberhoot.com/cybrary   Blog & Educational Articles: https://cyberhoot.com/blog   Newsletter Subscription: https://cyberhoot.com/newsletters   Special Listener Offer: Mention the code "Iferia Podcast" to receive 20% off your company's first year of CyberHoot. Chapter Timestamps 00:00 Welcome Craig Taylor: 30-Year Cybersecurity Veteran & Co-Founder of CyberHoot 01:46 The Evolution of Security: From Firewalls to the Human in the Chair 03:04 Cybersecurity as an Immature Discipline: Lessons from Law and Medicine 05:15 Deconstructing the NIST Password Mistake: The Danger of 90-Day Forced Rotations 06:51 Modern Password Hygiene: 15-Character Passphrases, MFA & Passkeys 10:20 Automating Credential Security: How Password Managers Defend Against Phishing Sites 14:26 Positive Fish Testing in Action: The Open-Book HootPhish Architecture 17:08 The Psychology of Learning: Why Shaming Creates Learned Helplessness in IT 19:02 25 Years of Breach Trends: The Human Factor from the Verizon DBIR 20:30 AI-Driven Phishing: Grammar-Free Pretexting & Session Token Theft 22:54 The vCISO Perspective: The Shift from Neglect to Misguided Punishment 26:00 What Does True Innovation Mean to You? (Positive Reinforcement Over Industry Hubris) 29:09 Free Resources for Individuals & 20% Discount with Code "Iferia Podcast"