SpySecure

15/10/2026

An overall phishing score can hide which employees need additional support.

A useful monthly security training report should show:

• The overall company trend
• Training completion and test results
• Who opened or clicked a simulated phishing e-mail
• Who submitted information
• Whether additional training was completed

Individual results should be handled confidentially and used for targeted follow-up, not public blame.

Ask your employee training provider whether management receives both company-wide and per-employee results.

If the report only shows an average, it may hide the behaviour that creates the greatest risk.

13/10/2026

A company laptop does not automatically make an employee’s personal AI account company-managed.

An employee may sign in to Codex, Claude Code or another AI tool using a personal account.

The agent can then work with company files, code or repositories through that employee’s device.

But the company may not control:

• The AI account
• The connected repositories and integrations
• The permissions granted to the agent
• Access removal when the employee leaves
• The account settings and retained activity

This creates a gap between access to company data and control over the account using that access.

AI agents used for company work should use company-managed accounts with limited permissions and approved integrations.

Start by identifying which AI tools are currently connected to company systems through personal accounts.

09/10/2026

A guest account can outlive the project it was created for.

External users are often given access for a legitimate reason:

• A supplier needs a document
• A consultant joins a project team
• A customer accesses a shared environment
• A former employee supports a temporary handover

The problem starts when nobody removes or reviews that access afterwards.

A list of guest accounts is not enough. You also need to know:

• Which files, groups and applications each guest can access
• When the account was last used
• Which internal employee owns the relationship
• Whether the access is still required

Prioritise guests with access to sensitive information or administrator rights.

Guest access is useful. Guest access without an owner or regular review becomes a security gap.

See the seven Microsoft 365 and Google Workspace security gaps we repeatedly find:

https://www.spysecure.nl/en/knowledge/security-gaps-microsoft-entra-google-workspace?utm_source=linkedin&utm_medium=organic_social&utm_campaign=b1_m365_gaps&utm_content=p17_guest_access

100% of the new customers SpySecure® onboarded in 2026 had one or more of these 7 security gaps. See the risks and practical checks.

08/10/2026

Does your daily e-mail account also have administrator rights?

The account used for e-mail, web browsing and documents has a much higher chance of encountering a malicious link or file.

If that same account also has administrator rights, compromising it may give an attacker powerful access to Microsoft 365, Entra ID or Google Workspace.

Administrators should use:

• A normal account for daily work
• A separate named account for administrator tasks
• Strong MFA on the administrator account
• No shared administrator credentials

Ask your internal IT team or IT provider to export all privileged roles and confirm that every administrator uses a separate account.

06/10/2026

One of the most encouraging responses to employee security training is a request for more time.

Employees occasionally tell us they were on holiday and ask us to extend the deadline because they still want to complete the training.

That is very different from an annual compliance course that employees click through as quickly as possible.

Security training becomes more engaging when it is:

• Short enough to complete during a working day
• Based on risks employees currently face
• Relevant to their role and behaviour
• Followed by a short test that confirms understanding

Our training videos generally take three to five minutes. A 100% test score is required, but employees can repeat the test and learn from incorrect answers.

A new module follows every two weeks.

The objective is not to occupy employees for as long as possible.

It is to keep security relevant without making training feel like a burden.

02/10/2026

A terminal command is not suspicious simply because an AI agent ran it.

It is not automatically safe for that reason either.

Your security tooling may see:

• Files being changed
• Terminal commands being executed
• New processes starting
• Packages being installed
• Repositories or connected systems being accessed

These actions could be part of a legitimate task performed by Codex or Claude Code.

They could also indicate that an attacker has gained access to the device.

The difficult part is connecting the activity to its purpose.

Did the employee request this specific action?
Was the additional access approved?
Did the agent remain within the expected project?

Without that context, useful AI activity makes genuine attacks harder to identify.

Read why AI-agent activity can resemble an external attack and what companies can do about it:

https://www.spysecure.nl/en/knowledge/ai-agent-activity-employee-or-attacker?utm_source=linkedin&utm_medium=organic_social&utm_campaign=b3_ai_agent_security&utm_content=p14_action_without_context

AI agents can change files, run commands and start processes on employee laptops. Learn why this can make real attacks harder to identify.

01/10/2026

Can company e-mail still be forwarded automatically to a personal or external address?

An old forwarding rule can silently copy every new message outside your Microsoft 365 or Google Workspace environment.

Ask your internal IT team or IT provider to export all rules that automatically forward e-mail externally.

For every rule, verify:

• The external destination
• The employee or inbox involved
• The current business reason
• Who approved and owns the exception

Remove rules that are unknown, obsolete or no longer necessary.

Checking whether external forwarding is technically available is not enough. You need to know which forwarding rules are currently active.

29/09/2026

One approval can significantly change what an AI coding agent is able to do.

An employee may initially give Codex or Claude Code access to one project folder.

During the task, the agent may then request permission to:

• Open another folder
• Run a terminal command
• Install a package
• Access the internet
• Connect to a repository or another system
• Approve similar commands for the entire session

Each request may appear reasonable because it helps the employee complete the task.

But after several approvals, the agent may have much broader access than it had when the work started.

This is why an approved-tools list is not enough.

Companies also need to understand which additional permissions employees grant while an AI agent is working.

At a minimum, retain the agent, employee, device, project and additional permissions approved during the session.

For sensitive files, new software and connected systems, require a separate check before access is granted.

25/09/2026

A 100% training completion rate does not mean employees will always act securely.

In the SpySecure® training programme, employees must score 100% on the short test after each module.

That confirms they understood the lesson at that moment.

It does not show how they respond several weeks later, during a busy working day, when a realistic phishing e-mail appears in their inbox.

That is why training and testing measure two different things:

• Training shows whether employees understand what to do
• Simulations show what employees actually do
• Follow-up training addresses the gap between the two

Management reporting should therefore include more than completion rates.

It should show training results, simulation results, individual risk and whether employees who clicked or submitted information completed additional training.

Completion is important. Changed behaviour is the objective.

Read how we combine recurring training, realistic simulations and targeted follow-up:

https://www.spysecure.nl/en/knowledge/employees-active-security-layer?utm_source=linkedin&utm_medium=organic_social&utm_campaign=b2_employee_security&utm_content=p11_completion_vs_behaviour

Employees face phishing, smishing, social engineering and AI risks. See how continuous training and realistic simulations improve security behaviour.

24/09/2026

Which AI tools already have access to your company’s devices, files or code?

Do not assume the official software list contains the complete answer.

Employees may use command-line agents, IDE extensions or locally installed tools such as Codex and Claude Code.

Ask your internal IT team or IT provider to record:

• Which AI agents are being used
• Who uses each agent and on which device
• Whether a company or personal account is used
• Which files, repositories and connected systems it can access

The first AI security gap is often not excessive access.

It is not knowing that the access exists.