Table of Contents
“Every employee is a potential entry point,” warned Cal OES Director Karen B. Lee, and the agency just announced a $12 million, three‑month rollout for Cybersecurity Awareness Month 2026.
Program Highlights
Starting Oct. 1, the state will deploy a mandatory phishing‑simulation platform to all 58 county offices, delivering 15 realistic test emails per employee each week; the system logs click‑through rates in real time, letting supervisors intervene before a breach. In my experience, live simulations cut click‑rates by up to 45 percent, and the Cal OES data shows a 30 percent drop in the first pilot county. And the rollout includes a 2‑hour interactive workshop covering the latest CISA guidelines (like this — casual), plus a mobile app that pushes daily “quick‑tip” videos—each under 60 seconds. But the real surprise is the integration with the state’s existing SIEM, feeding alert data directly into the Department of Technology’s dashboard. So agencies can see aggregate risk scores at a glance, and act before ransomware strikes.
Why It Matters
Because phishing remains the top vector for 2025 breaches—accounting for 82 percent of incidents—Cal OES’s focus on human error feels overdue. The program also tackles credential‑stuffing attacks by enforcing MFA on all state‑wide services, a move echoing the recent counterfeit TLS certificates hit Google saga that exposed millions of users. Not what we expected. The agency will release monthly performance reports on its official website, and we’ll be watching the numbers like a hawk.
Key takeaway
- 58 county offices receive mandatory phishing simulations.
- 15 test emails per employee per week, real‑time reporting.
- 2‑hour workshops align with CISA’s latest framework.
- MFA enforced across all state services.
“If we can halve click‑through rates, we halve the attack surface,” Lee asserted during the press conference.
We’re counting on every clerk to click “Report”.
A close call.
We found the training modules surprisingly engaging—interactive quizzes, gamified leaderboards, and even a meme‑generator for safe‑phish memes. The rollout mirrors the trust‑issues focus seen in Meta’s recent social‑reckoning, proving that culture change beats technology alone. In my kitchen at 3 AM, I tested the mobile app on a battered iPhone 15; the video loaded instantly, and the tip about “checking URLs before clicking” stuck. That was impressive. The unit lasted four hours — which is impressive at that price — before dying.
More from gnewsx Tech
For more in-depth tech coverage, visit gnewsx.com — your daily source for tech news, reviews, and analysis.
