The Human Firewall: Building a Culture of Cyber Vigilance

In this episode of Phishing for Answers, Joshua Crumbaugh sat down with Marcos Marrero, CISO of H.I.G. Capital, to discuss some of the unique security challenges in private equity and the importance of security awareness. Marrero shared fascinating stories about his team’s encounters with cyber threats and how they’ve built a security culture focused on vigilance.

A New Type of Scam: The Fake Data Room

Marcos described an elaborate scam targeting private equity firms, where attackers set up a fully functional data room to trick investors into acquiring a non-existent company. Complete with fabricated financials, NDAs, and MSAs, the scam was convincing enough to fool their analysts initially.

“They had decks, financials, NDAs, MSAs… and there was no indication these were stolen documents. They were crafted for this specific scam.” - Marcos Marrero

H.I.G. only caught the scam when their investment team planned a site visit and the scammers went silent—a powerful reminder that no organization is immune to increasingly sophisticated attacks. PhishFirewall’s AI cyber coach delivers continuous, role-based training to employees, preparing them to spot even the most convincing scams that target specific industries or workflows.

Phishing tactics are evolving fast—your team’s training should be, too. PhishFirewall’s AI cyber coach provides personalized, continuous training and real-world phishing simulations based on each user’s role. Visit PhishFirewall today to learn how we can help your team stay ahead of threats.

‍

Human Firewalls: Empowering Employees

One of the standout points from the episode was Marrero’s emphasis on turning every employee into a “human firewall.”

“Every employee is a human firewall. They’re on the front lines, receiving the phishing emails and facing the threats directly.” - Marcos Marrero

This is the essence of PhishFirewall’s approach—empowering users, not punishing them. Our platform is designed to transform every employee into a vigilant, well-trained defender through job-specific training and continuous phishing simulations that adapt to their behavior and risk level. Security isn’t just an IT function; it’s a company-wide culture, and PhishFirewall ensures that employees are equipped for that responsibility.

Reporting Suspicious Activity: It’s Not Just the IT Team’s Job

A key element of H.I.G.’s success is their “see something, say something” culture. Employees are encouraged to report any suspicious emails or behaviors, no matter how minor they seem.

“We’d rather take the time to investigate even if it turns out to be nothing. - Marcos Marrero

This proactive approach ensures that potential threats are addressed early, and employees feel comfortable speaking up, even if they’ve clicked on something by mistake. At PhishFirewall, we believe that proactive reporting is crucial. Our AI cyber coach teaches employees to recognize red flags early and take action, reinforcing the importance of vigilance in every role. By empowering users with ongoing training, we help organizations reduce their risk and create a more secure environment.

Security Awareness Goes Beyond the Office

Marrero’s team connects security awareness to employees’ personal digital lives, helping them understand that cybersecurity skills aren’t just for work.

“We stress that security awareness isn’t just about protecting the company—it’s about protecting you in your digital life.” - Marcos Marrero

PhishFirewall aligns with this philosophy, providing training that’s relevant not only to the workplace but to personal cybersecurity. By showing employees how these skills protect them in their everyday lives, we drive greater engagement and make security awareness more meaningful.

Want to build a security culture that extends beyond the office? PhishFirewall’s continuous, role-based training empowers employees to protect both their workplace and their personal lives from phishing threats. Discover how PhishFirewall can make your team the first line of defense.

‍

Lessons Learned: Keeping it Simple

Marrero emphasized the importance of simplicity in communication with non-technical stakeholders, from the board to frontline employees.

“Keep it simple. The jargon doesn’t matter—what matters is that they understand the risk and what they need to do about it.” - Marcos Marrero

This approach helps build buy-in from all levels of the organization and keeps cybersecurity accessible.

Key Takeaways:

• Encourage a “see something, say something” approach.

• Customize security training based on individual risk.

• Make cybersecurity personal by connecting it to employees’ daily lives.

• Keep communication simple to ensure everyone understands their role in security.

‍

#CyberSecurity #PhishingAwareness #HumanFirewall #SecurityCulture #PhishingForAnswers #Phishing4Answers

‍