with Craig Taylor
In part two of his conversation with Michael Palmer, CyberHoot founder Craig Taylor explains why cyber literacy is mostly common sense once you know what to look for. He clears up the old password-rotation myth, walks through the ClickFix attack, and makes the case for training your team with rewards instead of shame. You'll also hear what cybersecurity should cost per employee and where to start if you can only do one or two things.
Ask about this episode
Get instant answers with citations — powered by Ask the Show.
Show notes
See what the team at The Successful Bookkeeper has on right now →
In the finale of his two-part conversation with Michael Palmer, Craig Taylor turns from personal security to the business side: how to train a team so that one rushed click doesn't become a ransomware headache. Craig is the founder and CEO of CyberHoot, and his message is encouraging. Most of what protects your firm is simple habits, taught in a way people want to repeat.
Chapters
- [01:00] How often should you change passwords?
- [04:00] Passkeys and the human firewall
- [07:00] Why cyber literacy should be taught
- [09:00] ClickFix: the paste-a-command attack
- [12:00] The phishing rubric and two simple rules
- [16:00] Rewarding good behavior, not punishing
- [20:00] Gamification and AI-powered phishing
- [23:00] What cybersecurity training really costs
- [26:00] Where to start: risk assessments
- [28:00] CyberHoot trial and listener offer
Do you really need to change that password?
Michael opens with a question many of us get from clients: how often should the one password be changed? Craig's answer is "Never," as long as it's a long passphrase (20 characters or more) protecting your password manager and there's no sign of a breach. NIST rescinded its old 90-day rotation advice because "humans cheat," tacking on a year or a month and making the password easier for attackers to guess. Forced resets mostly create "entropy and chaos" and lockouts. Michael adds that passkeys have become the easy path, noting "it's more secure and it's faster."
Cyber literacy is the missing basic skill
Craig points out that we graduate people from school with reading, writing, and arithmetic but no cyber literacy, even though everyone runs their working life on a computer. He sees most breaches tracing back to human mistakes, and the fix is a program inside the company. His core rule for spotting trouble is to be suspicious whenever someone asks you to act "urgently, emotionally, with authority or secrecy," and to verify out of band by calling a known good number.
ClickFix and the attacks to know about now
Craig's example of the moment is ClickFix, which the FBI issued an advisory on in September. A website asks you to prove you're human, then tells you to open a command prompt and paste in something it supplied. That pasted command is a PowerShell script that hands over remote access. His rule: "No human test has ever asked you to paste something onto your computer." He also mentions last year's smishing wave (the fake toll-violation texts) and says CyberHoot produces 12 new videos a year to cover whatever attackers did in the previous 12 months.
Carrots, not sticks: training that changes behavior
Phishing remains the top way into firms of 500 people or fewer, according to the Verizon breach report, and Craig says two habits stop nearly all of it: check the sender closely for one-letter differences like typosquatting, and call the person when a request is strange. He argues that punishing clicks doesn't change behavior. With a psychology background and years as a hockey coach, he favors positive reinforcement, such as taking your top performers to lunch instead of calling out the laggards at an all-hands. Gamification (levels, avatars, an anonymous leaderboard) turns training from work into play, and the repetition builds muscle memory: "go check the sender because I've done it 50 times."
What it costs and where to start
Craig puts training at roughly $1.50 to $3 per employee per month, against a breach that can cost "a million times" more, and notes that insurers increasingly require training and non-punitive phishing simulations before they'll cover a claim. If you can only do one thing, adopt a password manager and turn on MFA. Next comes awareness training, and after that a risk assessment from a fractional or virtual CISO so you spend limited time and money on your biggest risks first, whether administrative, technical, or physical.
Links mentioned
- CyberHoot: cyberhoot.com (book a demo; free 30-day trial)
- Free individual training: cyberhoot.com/individuals
- Sales contact: sales@cyberhoot.com
- Listener offer: mention The Successful Bookkeeper for 20% off your first year of CyberHoot services
- Part one of the conversation with Craig Taylor (previous episode)
- More resources: thesuccessfulbookkeeper.com
About the guest
Craig Taylor is the CEO and founder of CyberHoot, a company that builds cybersecurity awareness training and positive-reinforcement phishing simulations for businesses of all sizes. A lifelong cybersecurity professional with a psychology background and a level 4 certified hockey coach, he has built CyberHoot around the idea that people learn secure habits best when they're rewarded for them. The company recently received a patent for its approach to positive-reinforcement phishing simulation.
About the host
Michael Palmer
Michael Palmer is the host of The Successful Bookkeeper podcast — almost 600 episodes and counting — and founder of The Successful Bookkeeper Global. He's spent over 15 years in the bookkeeping industry, working one-on-one with thousands of bookkeepers across the globe. He started this work because of his father — a brilliant electrical contractor who worked twice as hard as he should have had to, because nobody on the financial side was in his corner. That gap is what The Successful Bookkeeper exists to close. His view: bookkeepers are the most undervalued force in small business — and every bookkeeper who builds a real business changes two families: theirs, and their clients'.
Full transcript
[00:00] Craig Taylor: Teaching people these little bits of knowledge around social engineering, whether it's delivered via phone, text, QR code, or email, is really, really helpful because it's not rocket science. It's, it's very common sense stuff, but you have to know what you're looking for.
[00:25] Ad Read: You're listening to The Successful Bookkeeper with your host, Michael Palmer. Listen each week as inspiring guests share their secrets of success to help you increase your confidence, work smarter, and build a business you love.
[00:41] Michael Palmer: Welcome back to the Successful Bookkeeper Podcast. I'm your host, Michael Palmer. It's the finale of our 2-part conversation with Craig Taylor, founder and CEO of Cyberhoot. This time we're focusing on the business side of cybersecurity and how to better prepare your team for the threats ahead. Let's rejoin the conversation right now. How often do I need to change that one password?
[01:08] Craig Taylor: Never.
[01:10] Michael Palmer: The one that I'm logging into.
[01:12] Craig Taylor: Yeah, if you have one password on your computer and you've set a 20-character passphrase, right? I'm not talking about a 10-character password. I'm talking about 20 or more characters. The ability to crack that through a brute force attack or even an intelligent attack is almost zero for today's computers. Now, quantum computing down the road, maybe we get a different answer to this question. But NIST updated their advice. They had published very bad advice 20 years ago. NIST, for everyone listening, is the National Institute of Science and Technology. They create standards like how do— how are we supposed to use different technologies? What are the safety requirements and that sort of thing? And they made some really bad advice in 2003, which they rescinded. One of it was change your passwords every 90 days. And they rescinded that because humans cheat. When you have your favorite root password, people were just adding on 2002, 2007, 2014, '22, '26. That's how they updated their passwords every 90 days, or July 26th, or whatever it is. But people would cheat, and hackers could see that because they got your password in clear text when they breached different SaaS vendors, software as a service vendors, or websites. when they weren't encrypted and hashed properly. So what NIST said was, don't force password resets unless there's been an expected breach of the knowledge of that password. So if you're using a
Read the full transcript
Members get full transcripts of every episode, plus unlimited Ask the Show questions across 500+ conversations with world-class bookkeepers.
Become a member