When we send a Microsoft HootFish, we change the M in Microsoft.com to an R followed by an N.
1. Episode 113 of the Mastering Risk Management Podcast covers how positive-reinforcement training changes employee behavior against phishing and other cyber threats.
2. Host Anthony Wilson interviews Craig Taylor, a CISSP since 2001 and 25-year cybersecurity veteran who has led security teams at CSC, JP Morgan Chase and Vistaprint.
3. Taylor co-founded CyberHoot in 2014 to bring cyber literacy training to small and medium businesses and MSPs, applying the behavioral psychology he studied as an undergraduate.
4. He says the common approach of sending fake phishing emails and punishing clicks, with meetings, three-strikes rules or a 45-minute video, never teaches people when to click and when to phone the sender.
5. CyberHoot's HootFish exercise instead quizzes users in real time on seven email components (sender, greeting, subject, spelling, urgency and emotionality, links, attachments), using typosquatted domains such as an 'rn' replacing the 'm' in Microsoft.com.
6. Taylor says CyberHoot has filed a patent on its positive-reinforcement simulations and that three US universities have started an empirical study of the approach, and he compares it to dog training with treats instead of shock collars.
7. He reports that the latest weekly feedback rated HootFish simulations 87% positive and videos 81%, against a historical 85-95% for videos, and that some older AI-generated videos bother a small minority of viewers because of off voices and extra fingers.
8. Taylor says illicit models such as FraudGPT remove guardrails so attackers can generate grammatically perfect emails and register look-alike domains, and he notes that CyberHoot monitors lookalikes of its own domain, including a 'cyber.rhoot.com' variant.
9. On the virtual CISO side, he describes assessments under NIST 800-171 that rank risks by impact, probability and materiality to the business, plus policy gaps such as missing rules for unique passwords over 15 characters stored in a password manager, and the risk of putting data like the Coca-Cola formula into a public LLM.
10. Risk and security professionals, MSP owners and anyone weighing a cybersecurity career will get the most from it.
