Author
CEO, Hook Security
Zach Eikenberry is co-founder and CEO of Hook Security, where he developed the PsySec approach behind its training, and author of Psychological Security: How Human Behavior Shapes Modern Cyber Defense. He previously served as executive director of two public high schools and a middle school.
Seventeen proven phishing simulation templates in five groups: delivery notices, account alerts, gift cards and freebies, internal HR messages, and collaboration invites, plus how to rotate them.
Three proven social media phishing templates, Venmo, LinkedIn, and X (Twitter), with the red flags for each and how to train employees to check in the app instead of the inbox.
Three proven healthcare phishing templates with the red flags to teach, why healthcare is targeted, and how phishing simulations support HIPAA security awareness training.
Two free Cybersecurity Awareness Month kits from Hook Security, updated for the 2026 theme “Don’t Make It Easy for Them”: posters, videos, social posts, email templates, a press release, and a four-week plan.
Most “MSP-ready” security awareness tools are single-tenant platforms with MSP features bolted on. This guide explains what true multi-tenant architecture looks like for security awareness training, how to spot bolt-on MSP tiers in demos, and why the difference determines whether your SAT service line scales profitably.
Nick Wolf, VP of Sales at Hook Security, returned to KnowTechTalk to talk about AI-written phishing, whether today's security awareness training actually prepares people for it, and why the premise that people are the problem gets the whole thing backwards.
Co-managed security awareness training is a hybrid model where MSPs own program design and strategy while the vendor automates delivery, execution, and reporting. This guide explains how responsibilities split, when co-managed makes sense, and how it compares to self-service and fully managed models.
For MSPs, the real decision in security awareness training isn’t which vendor to choose—it’s whether to run a self-service platform in-house or partner with a done-for-you provider. This guide breaks down how each model impacts margin, scalability, and client retention so you can pick the approach that fits how your team actually operates.
Human risk management is the right diagnosis and, in most products, the wrong prescription. What the largest independent phishing study found about the simulate-and-score loop — and what it found does work.
A practical 25-term glossary for MSPs covering security awareness training models, phishing simulations, training delivery, platform architecture, and MSP business terms—built from Hook Security’s work with 500+ MSP partners.
Most MSPs stay with the wrong security awareness training vendor longer than they should because migration feels painful. Here are five clear signs your SAT platform is holding back your operations, client relationships, and growth—and how to evaluate a better-fit replacement in under an hour.
Hook Security earned five G2 Fall 2026 badges, all computed from verified user reviews: High Performer, High Performer (Mid-Market), Best Support (Mid-Market), Easiest To Do Business With (Mid-Market), and Best Meets Requirements (Mid-Market). It is Hook’s fifth G2 High Performer recognition since the Winter 2022 report.
In 2026, phishing simulations are a commodity. MSPs that keep selling them as the product get stuck in feature wars, checkbox programs, and risky renewals. The MSPs winning on margin and retention now sell behavior change as the product — with phishing simulations, training, and reporting positioned as mechanisms that deliver measurable human-risk improvement.
MSPs: Run security awareness without the busywork. Learn the Plan-Launch-Nudge-Prove-Improve framework for autopilot awareness training.
Learn what a managed security awareness program really is from an MSP perspective, how it differs from self-service and co-managed SAT, what genuine managed delivery includes, and how Hook Security’s Security Awareness on Autopilot model helps MSPs scale with predictable margins and better client retention.
A five-section QBR template for reporting security awareness results to clients in 15 minutes — metrics, narrative, and next quarter's plan.
Five tests that separate genuinely done-for-you security awareness training from marketing copy — onboarding, reporting, and support standards for MSPs.
A 12-month security awareness calendar for MSPs: monthly training themes, phishing simulations, and a QBR rhythm you can run for every client.
Four pricing models MSPs actually use for security awareness training in 2026, with honest economics, margin math, and when each model fits.
What a good MSP security awareness stack looks like in 2026: five operational dimensions, honest benchmarks, and where average stacks leak margin.
The 8 best security awareness training platforms for MSPs in 2026, compared on multi-tenant management, margin, admin time, and engagement.
The best security awareness training for small business in 2026, compared on price, admin time, and completion — published pricing included.
What psychological security (PsySec) is and why psychology beats fear in security awareness training — the science behind Hook's methodology.
25 verified security awareness and phishing statistics for 2026 - every number sourced to a primary report, plus 3 famous stats we refuse to cite (and why).
What cyber insurance carriers require from security awareness training in 2026 — application questions, underwriting thresholds, and documentation MSPs need.
Hook Security’s 2024 Training Catalog introduces over 20 new modules and an annual course with 12+ micro-trainings, blending innovative approaches like PsySec (Psychological Security), interactive storytelling, and just-in-time learning to elevate security awareness. These new offerings provide tailored, engaging compliance and cybersecurity training, empowering employees to proactively protect against evolving threats.
Hook Security and Haekka bring security awareness training directly into Slack — micro-training where your team already works, no separate portal.
Join the February 2025 Orlando conference addressing deepfakes' role in social engineering, offering insights, tools, and strategies for detecting and defending against digital manipulation.
Hook Security recently made the decision to sign the "Truth in Cyber" pledge, a move that underscores our commitment to fostering transparency and trust in the cybersecurity industry.
In this blog post, we're exploring some dynamic trust-building activities that can strengthen trust within your team and foster a security-first mindset.
This blog post examines nine workplace security tips to reinforce your security posture and ensure your organization remains safe and secure.
Introducing Tech Stack Tips - our brand new training series designed to supercharge productivity and enhance security across your organization's tech infrastructure!
Looking for a KnowBe4 alternative? Honest 2026 comparison of 10 security awareness training platforms for MSPs and SMBs — strengths and watch-outs.
Introducing our latest free resource: "Off The Hook: A Practical Guide to Spotting and Avoiding Phishing Threats." Offering a deep dive into the murky waters of phishing scams and attacks.
In this blog post, we'll share ten essential phishing awareness tips that you can share with your employees, empowering them to be an active part of your defense strategy against cyber threats.
In this blog post, we discuss the importance of cross-functional collaboration and how it can boost an organization’s security posture.
In this blog post, we dive into the realities of deploying a Security Awareness Training initiative in schools and offer recommendations to kickstart security initiatives!
In this blog post, we explore some free game-changing tools you can incorporate into your security programs.
In this blog post, we dive into the most prevalent phishing techniques of the year and explore strategies to safeguard against them.
In this blog post, we'll delve into practical strategies and key performance indicators that will help you qualitatively assess the impact of your security awareness initiatives.
In this blog post, we'll explore the pivotal role of teaching cybersecurity psychology to employees and dive into why it matters in safeguarding organizational integrity.
We dive into the relationship between security awareness training and employee productivity. We explore how a well-structured and comprehensive training program can serve as a stepping stone for a more vigilant, informed, and ultimately productive workforce.
Introducing Hook Studios, our brand-new, absolutely free content hub created specifically for security awareness professionals!
In this blog post, we dive into the key steps involved in training employees on malware prevention.
In this blog post, we'll dive into how you can effectively train employees on physical security.
How to train employees on phishing awareness: realistic simulations, positive coaching instead of punishment, and micro-training that people actually finish.
In this video, we dive into our top three most popular fast food phishing templates!
Dive into the depths of the cyber ocean and explore the treacherous world of phishing scams and attacks with “Beneath The Surface: A Guide to Phishing Emails and the Creatures Behind Them.” We’ll take you on an underwater adventure, where you’ll encounter a wide array of sea creatures that serve as metaphors for different types of phishing scams and attacks.
To counteract the impact of social engineering attacks, employee training programs are essential for creating a secure work environment. In this article, we will discuss step-by-step how to train employees on social engineering techniques.
Our three highest-clicked phishing templates and why they work — the psychology behind each lure and what it teaches about training your employees.
Phishing for Answers is a video series answering common questions about phishing, ransomware, cybersecurity, and more. These videos are great to share with your colleagues, friends, and family! Today we’re talking about malware.
How to train employees on incident response: what to report, who to tell, response playbooks, and practice drills that make reporting a reflex.
Webinar featuring Hook Security and ByteChek. What it means to build a healthy security awareness training culture.
Because hackers are consistent with the way they intricately develop new scams, knowledge concerning popular phishing scams is paramount. When we combine the characteristics of a typical phishing email and supply the information regarding standard phishing email content, we're preparing employees and consumers to avoid data theft. In this article, we take a look at the most common phishing emails of 2021.
Phishing for Answers is a video series answering common questions about phishing, ransomware, cybersecurity, and more. These videos are great to share with your colleagues, friends, and family! Today we’re talking about smishing.
Phishing for Answers is a video series answering common questions about phishing, ransomware, cybersecurity, and more. These videos are great to share with your colleagues, friends, and family! Today we’re talking about internal phishing emails.
Phishing training is only one aspect of security awareness training, but it’s arguably the most important cybersecurity training you can deliver to your employees. Not only is it a relatively simple concept to understand, but it’s also the most likely form of attack your employees will see regularly. Here’s how to tell if it’s time to invest in phishing training for your organization.
Phishing testing for employees is essential in that it ensures employees can adequately spot and avoid complicated phishing attacks. When accompanied with an instant training moment, sending employees phishing tests can help your users become more aware of popular phishing tricks and tactics.
Security awareness training is one of the best ways to fight cybercrime. But, some organizations and employees haven’t embraced this solution. This situation is due, in part, to a lack of understanding about cybersecurity education in the workplace.
Phishing for Answers is a video series answering common questions about phishing, ransomware, cybersecurity, social engineering, and more. These videos are great to share with your colleagues, friends, and family! Today we’re talking about website phishing.
Realizing that you have been a victim of phishing is a terrifying experience. Phishing has rapidly evolved over the last decade, which means that these attacks have become more sophisticated than ever. They allow attackers to gain confidential information which could put your personal and business finances and data at great risk.
This video covers our top three brand knockoff phishing templates.
Phishing for Answers is a video series answering common questions about phishing, ransomware, cybersecurity, and more. These videos are great to share with your colleagues, friends, and family! Today we’re talking about malware.
Phishing for Answers is a video series answering common questions about phishing, ransomware, cybersecurity, and more. These videos are great to share with your colleagues, friends, and family! Today we’re talking about spear phishing.
In this blog, we’ll walk you through some real-world examples of companies who sent these types of phishing emails to their employees and how to not follow in their footsteps.
Phishing for Answers is a video series answering common questions about phishing, ransomware, cybersecurity, and more. These videos are great to share with your colleagues, friends, and family! Today we’re talking about how social media affects your digital security.
Five key questions to ask before buying compliance training: coverage, format, tracking, updates, and engagement — so you choose training employees finish.
With phishing attacks growing in scale and sophistication, they are becoming more difficult to detect and even harder to evade. The most dangerous mindset is thinking that it can’t happen to you or that you would recognize one of these attacks. Today’s sophisticated attackers craft legitimate-looking targeted phishing campaigns designed to hook even the most seasoned user. Here are 10 real-world phishing attacks that could have been prevented.
The holiday season is rife with opportunities for cybercriminals to make a quick buck, so it's important to be on your guard. While the specifics of phishing attempts often change every year, here are the most common holiday phishing scams that target small businesses during the holiday season.
Cybercrime is growing at an alarming rate, and a key element of any company's cyber defense strategy should be security awareness training. However, training is often not effective because of various myths and misconceptions. So we've outlined some of the top misconceptions when it comes to security awareness training.
As a security professional, one of your responsibilities is to ensure that the personnel in your company are aware of cyber threats and how they can be avoided. It's important for you to provide awareness training on a regular basis, but when it comes down to it, people will need reminders throughout the year. So here's a list of 10 best practices you should use in your security awareness training:
How to communicate the seriousness of cybersecurity with employees while also encouraging a healthy security awareness culture.
Like many things, cybersecurity has some misconceptions out there. But believing in these myths could come at a cost. With the number of breaches growing, The right tools in place and a security awareness training program could help in protecting you, your employees, and your company. So here are 5 cybersecurity myths that may be putting your business at risk for a breach.
The goal of this article is to help Hook Security’s partner MSPs benefit from my sales team’s experience with a tactic we’re all familiar with: cold-emailing.
The holiday season is upon us, which unfortunately also means that it’s high season for cybercrime. The top threat for small businesses this time of year is phishing.
When looking to drum up new business for your MSP, you may often look toward one thing: lead generation.“Where is my next customer coming from?” you may ask. Lead generation is not the end-all-be-all of your sales and marketing efforts, but it’s certainly a great place to start.
In a world where over 90% of security breaches involving a phishing element, a company’s employees become the most vulnerable piece but also the greatest asset in security. Technical tools can only be so successful, and it’s up to your employees to recognize the threat. Security awareness training can help.
Search engine optimization (SEO) is huge as an MSP, as many people search online before selecting a service provider. The idea of Local SEO takes that even a step further by optimizing for your local market.