Video summary

Why Your Employees Are Your Biggest Cybersecurity Risk Right Now

Main summary

Key takeaways

News and Commentary

Core Argument: Employees as the “Biggest Cybersecurity Risk” (and Why)

The video argues that employees are the biggest cybersecurity risk not because they’re incompetent, but because social engineering exploits normal human behavior—especially when people are busy, distracted, or under pressure.

With AI, these attacks are easier to:

  • Scale
  • Personalize
  • Appear authentic quickly

Examples cited include:

  • Cloning a CEO’s voice
  • Generating highly convincing phishing emails
  • Producing convincing deepfakes in minutes

This lowers the barrier for organized cybercrime.

The key idea: the problem isn’t that people don’t care—it’s that attackers design attacks around how people naturally behave.

Why “Weakest Link” Is Misleading

A major point is that the “weakest link” framing is incorrect. The guest emphasizes that targeted professionals (e.g., managing partners, clinicians, executives) can be deceived because attackers:

  • Do their homework
  • Exploit trust issues
  • Use urgency cues
  • Apply psychological triggers

Therefore, the solution isn’t only better technology—it’s building a security culture where staff routinely:

  • Notice suspicious requests
  • Report them
  • Verify before acting

What Works (Per the Guest’s Experience with No Before)

1) Simulated phishing/training that isn’t punitive

The platform reframes phishing tests as practice—“fire drills”—with:

  • Feedback loops
  • Education on the why behind attack tactics
  • Special attention to adults (not just rote testing)

2) Turning reporting into a cultural norm (“fish alert button”)

Employees can report suspicious messages instantly (e.g., via an Outlook/phone button).

This changes the dynamic from:

  • People quietly failing / staying silent to:

  • People actively helping defend the organization

Reporting also enables IT/security teams to triage and remove threats quickly.

3) Gamification and rewarding verification

Instead of stigmatizing those who get tricked, organizations should:

  • Reward reporting
  • Encourage quick verification behavior

Real-World Anecdotes Illustrating Impact

Law firm near a $1M transfer

A law firm nearly transferred ~$1 million after attackers were already inside email systems and used urgency.

What stopped it:

  • A trained lawyer recognized red flags
  • The lawyer verified via phone
  • The organization learned the attacker had been locked out (MFA enabled; password changed)
  • Result: the transfer to the attacker was prevented

Stigma as a barrier to learning

The discussion also notes that breaches and scams carry stigma, which can lead people to assume:

  • “It won’t happen here.”

Training must address this by normalizing reporting and verification.

AI-Specific Commentary

Because AI can make messages and emails look real, the guest argues people should stop obsessing over “real vs fake” content and instead focus on intent:

  1. Ask whether the message is asking you to do something against your interests
    • Wire transfers
    • Releasing information
    • Urgent actions
  2. Verify with a human before acting

No Before also supports an ADA deepfake/voice simulation tool for education, designed with vetted scripts so deepfakes are used to teach red-flag recognition—not to facilitate fraud.

The guest notes that deepfakes used to be hard to produce (requiring extensive samples), but now they can be generated quickly and improve continuously—meaning training must evolve with the threat landscape.

Product / Organizational Claims

  • No Before uses a training platform with:

    • Simulated phishing
    • Layered email protection (inbound/outbound)
    • AI agents to scale defense and education

  • Measurable reductions in phishing outcomes are reported, including:

    • Click rates dropping from around 30% toward much lower levels over time
    • A “never zero” expectation remaining

  • The company offers security culture surveys to benchmark and track:

    • Organizational risk posture
    • Learning needs

This is positioned as more interactive/actionable than traditional external consulting.

  • Content is delivered via an evergreen subscription (similar to Netflix):
    • Continual updates
    • Frequent new modules
    • Retirement of older content

What’s Next

  • Upcoming events and premieres, notably KCON / “Kaforcon” in Orlando for the Inside Man (Season 7) world premiere
  • Additional international premieres
  • More “Chameleon” content
  • Continued demo recordings

Presenters / Contributors

  • John Just — Head of Global Education / Chief Learning Officer, No Before
  • Brian Palma — CEO, No Before
  • Perry Carpenter — mentioned as part of No Before’s expert discussions
  • Roger Grimes — mentioned for upcoming recordings
  • Kevin Mitnik — referenced as part of No Before’s history/demos (“in spirit”)
  • Roger Grimes, Perry Carpenter, and the Inside Man cast — mentioned as contributors to upcoming demo/recording efforts

Original video