Once, during an #awareness session, I brought a jar into the room.One of those old-school glass jars with a metal lid.I put it on the table and asked the executives (not the CISOs) to drop a poker chip inside.Yes, poker chips. Don’t laugh. That’s what I had.The value of each chip was supposed to reflect two things: perceived risk and willingness to spend.At the beginning, the jar looked miserable.Two or three 50s.One brave 500.Fewer than ten 100s.Then came lunch.Paid for, obviously.But lunch was also the exercise.Heavy #socialengineering. Casual conversation. Names, routines, vendors, habits, internal friction, travel plans, tools, weak points, ego, trust.Then the last two hours began.Real risk demonstration.#spearphishing built with information collected during lunch.Fake WhatsApp chats after recon.#OSINT before the session even restarted.QR codes everywhere.Then we talked about recovery costs.Regulatory fines.Production downtime.Loss of trust.Reputational damage.The unpleasant difference between “unlikely” and “not impossible”.And, magically, the jar filled up with 500 and 1000 chips.You don’t fucking say.My #Decoded for #Baited: https://blog.baited.io/2026/cost-of-phishing-shrinking-budgets/
