10/02/2026
Real talk: the CEO gift card email is still working.
You know the one. Comes in at 4:47pm on a Friday. Subject line is just "Quick favor." Sender name matches your CEO exactly, email address is [email protected]. Message says they're in meetings all day and need you to pick up gift cards discreetly.
It is not sophisticated. It should not work.
It works constantly — because it targets the one thing no security tool patches: a helpful employee who doesn't want to say no to the boss.
That's the whole game. Attackers aren't beating your technology. They're beating your org chart.
Security awareness training fixes this by giving people permission to pause. To verify through a second channel. To ask a slightly awkward question instead of quietly complying.
Coggno's cybersecurity library covers exactly these scenarios — phishing, BEC, social engineering — in courses short enough that people actually finish them.
Nobody's getting fired for double-checking. Make sure your team knows that.