Why Security Awareness Training Fails – and What Works Instead
Companies spend billions on security awareness training. Yet, phishing click rates do not sustainably decrease. The problem isn't a lack of training but the …
Author profile
Tobias Massow
Tobias Massow is Managing Director of Evernine Media GmbH and publisher of SecurityToday. He oversees the strategic direction of the magazine and the entire MBF Media network.
Articles by Tobias Massow
188 articles 
Cyber Insurance and Incident Response: The Interaction in an Emergency
In an emergency, cyber insurance and incident response work together - or they don't. The insurance provides forensic experts, lawyers, and crisis communication. But …
Email Security Beyond Spam Filters: DMARC, BIMI, and the Future of Email Authentication
Google and Yahoo have made DMARC authentication mandatory since February 2024 - for all senders with more than 5,000 emails per day. Those who …
Why Your Cyber Insurance May Not Pay Out in a Crisis – The Industry’s Toxic Exclusion Clauses
Cyber insurance is booming - the market grows by 25 percent annually. But the disillusionment comes when a claim is made: More and more …
Passkeys 2025: The Practical Guide to Enterprise Implementation
By 2025, passkeys will no longer be an experiment. Apple, Google, Microsoft, GitHub, and Okta support them natively. The FIDO standard is stable, the …
Digital Geneva Convention: Why International Law Fails in Cyberspace
Hospitals, power grids, water supply - protected in physical war by the Geneva Conventions. In cyberspace: Fair game. While states massively expand their offensive …
Cybercrime declining – but only domestically
Just as overall crime rates are declining, so are cyberattacks, fraud, and cyberbullying on the internet. However, this only applies to incidents originating domestically. …
Germany’s Cybersecurity is an Illusion – Why BSI Reports and NIS2 Lull Us into a False Sense of Security
Germany positions itself as a cybersecurity leader - with BSI situation reports, NIS2 implementation, and KRITIS regulation. Yet the reality in companies and authorities …
Threat Intelligence: Identify Threats Before They Strike
Threat Intelligence transforms cybersecurity from reactive to proactive: Instead of waiting for attacks, companies identify threats before they become effective. The key lies not …
€5.10 – That’s All Germans Spend on IT Security
Most Germans are stingy when it comes to IT security and spend only a few euros per month on it. Consequently, even the simplest …
Cyberattacks with and without AI are becoming more aggressive
The 2025 Global Threat Report by US security firm CrowdStrike highlights a massive increase in cyberattacks and espionage activities from China and North Korea. …
Case Study: Hospital Thwarts Cyberattack Thanks to OT Segmentation
A maximum care hospital became the target of a cyberattack. The attackers compromised the administrative network but failed due to the segmentation of medical …
Case Study: Achieving NIS2 Readiness in 6 Months — A Utility Company Shows How It’s Done
A utility company with 900 employees achieved NIS2 readiness in 6 months -- with a limited budget and without external consulting firms. The key: …
Case Study: Cloud Migration of a Financial Services Provider — Security from the Start
A financial services provider has migrated its core applications to the Azure Cloud - with security as an integral part from day one. Result: …
Case Study: Zero-Trust Migration at an Insurance Corporation
An insurance corporation with 8,000 employees migrated its network architecture to Zero Trust in 18 months. The results: 73% fewer VPN support tickets and …
One in Four Deliberately Uses Simple Passwords
On "Change Your Password Day" on February 1, 2025, the Bitkom industry association published figures on how Germans handle their passwords. The results are …
BSI: Critical Infrastructures Particularly at Risk in 2024
According to the BSI (Federal Office for Information Security), cybersecurity incidents targeting critical infrastructures, known as KRITIS, have significantly increased in 2024. Not all …
Case Study: Spear-Phishing Campaign Targeting Automotive Supplier — 200 Employees in the Crosshairs
An automotive supplier became the target of a targeted spear-phishing campaign. The attackers imitated a real supplier - thanks to security awareness training, 94% …
Case Study: Mid-Sized Manufacturer Detects APT After 9 Months – Thanks to THOR Scan
A machinery manufacturing company discovered during a routine compromise assessment with THOR that attackers had been active in their network undetected for 9 months. …
Insider Threats: When the Danger Comes from Within Your Own Company
60 percent of all data losses are due to insiders - whether malicious, negligent, or compromised. While companies invest millions in perimeter security, the …
Checklist: Planning Your 2025 Security Budget
Budget season is here. This checklist helps CISOs and IT directors plan their 2025 security budget in a structured way - from inventory to …
