See what the team at The Successful Bookkeeper has on right now →
In the finale of his two-part conversation with Michael Palmer, Craig Taylor turns from personal security to the business side: how to train a team so that one rushed click doesn't become a ransomware headache. Craig is the founder and CEO of CyberHoot, and his message is encouraging. Most of what protects your firm is simple habits, taught in a way people want to repeat.
Chapters
- [01:00] How often should you change passwords?
- [04:00] Passkeys and the human firewall
- [07:00] Why cyber literacy should be taught
- [09:00] ClickFix: the paste-a-command attack
- [12:00] The phishing rubric and two simple rules
- [16:00] Rewarding good behavior, not punishing
- [20:00] Gamification and AI-powered phishing
- [23:00] What cybersecurity training really costs
- [26:00] Where to start: risk assessments
- [28:00] CyberHoot trial and listener offer
Do you really need to change that password?
Michael opens with a question many of us get from clients: how often should the one password be changed? Craig's answer is "Never," as long as it's a long passphrase (20 characters or more) protecting your password manager and there's no sign of a breach. NIST rescinded its old 90-day rotation advice because "humans cheat," tacking on a year or a month and making the password easier for attackers to guess. Forced resets mostly create "entropy and chaos" and lockouts. Michael adds that passkeys have become the easy path, noting "it's more secure and it's faster."
Cyber literacy is the missing basic skill
Craig points out that we graduate people from school with reading, writing, and arithmetic but no cyber literacy, even though everyone runs their working life on a computer. He sees most breaches tracing back to human mistakes, and the fix is a program inside the company. His core rule for spotting trouble is to be suspicious whenever someone asks you to act "urgently, emotionally, with authority or secrecy," and to verify out of band by calling a known good number.
ClickFix and the attacks to know about now
Craig's example of the moment is ClickFix, which the FBI issued an advisory on in September. A website asks you to prove you're human, then tells you to open a command prompt and paste in something it supplied. That pasted command is a PowerShell script that hands over remote access. His rule: "No human test has ever asked you to paste something onto your computer." He also mentions last year's smishing wave (the fake toll-violation texts) and says CyberHoot produces 12 new videos a year to cover whatever attackers did in the previous 12 months.
Carrots, not sticks: training that changes behavior
Phishing remains the top way into firms of 500 people or fewer, according to the Verizon breach report, and Craig says two habits stop nearly all of it: check the sender closely for one-letter differences like typosquatting, and call the person when a request is strange. He argues that punishing clicks doesn't change behavior. With a psychology background and years as a hockey coach, he favors positive reinforcement, such as taking your top performers to lunch instead of calling out the laggards at an all-hands. Gamification (levels, avatars, an anonymous leaderboard) turns training from work into play, and the repetition builds muscle memory: "go check the sender because I've done it 50 times."
What it costs and where to start
Craig puts training at roughly $1.50 to $3 per employee per month, against a breach that can cost "a million times" more, and notes that insurers increasingly require training and non-punitive phishing simulations before they'll cover a claim. If you can only do one thing, adopt a password manager and turn on MFA. Next comes awareness training, and after that a risk assessment from a fractional or virtual CISO so you spend limited time and money on your biggest risks first, whether administrative, technical, or physical.
Links mentioned
- CyberHoot: cyberhoot.com (book a demo; free 30-day trial)
- Free individual training: cyberhoot.com/individuals
- Sales contact: sales@cyberhoot.com
- Listener offer: mention The Successful Bookkeeper for 20% off your first year of CyberHoot services
- Part one of the conversation with Craig Taylor (previous episode)
- More resources: thesuccessfulbookkeeper.com
About the guest
Craig Taylor is the CEO and founder of CyberHoot, a company that builds cybersecurity awareness training and positive-reinforcement phishing simulations for businesses of all sizes. A lifelong cybersecurity professional with a psychology background and a level 4 certified hockey coach, he has built CyberHoot around the idea that people learn secure habits best when they're rewarded for them. The company recently received a patent for its approach to positive-reinforcement phishing simulation.
About the host
Michael Palmer
Michael Palmer is the host of The Successful Bookkeeper podcast — almost 600 episodes and counting — and founder of The Successful Bookkeeper Global. He's spent over 15 years in the bookkeeping industry, working one-on-one with thousands of bookkeepers across the globe. He started this work because of his father — a brilliant electrical contractor who worked twice as hard as he should have had to, because nobody on the financial side was in his corner. That gap is what The Successful Bookkeeper exists to close. His view: bookkeepers are the most undervalued force in small business — and every bookkeeper who builds a real business changes two families: theirs, and their clients'.
