AI Security Awareness: Emerging Risks and How to Use AI Safely at Work
AI can improve productivity, but it also creates new risks involving sensitive data, inaccurate outputs, shadow AI, phishing, deepfakes, malicious tools, and overreliance. This Hotman Group security awareness resource explains how employees can use AI more safely at work.
The Audit Trap: Why Passing isn’t Protection
Passing a cybersecurity audit does not automatically mean an organization is secure. Cheri Hotman and Troy Fine explain how checkbox compliance, weak audit practices, false confidence, poor resourcing, and overreliance on automation can undermine real risk management.
Social Engineering Awareness: How to Recognize Phishing, Smishing and Vishing
Social engineering attacks use trust, fear, urgency, and impersonation to manipulate people into clicking links, sharing information, or providing access. Learn how to recognize phishing, smishing, vishing, and other common social engineering tactics.
CMMC Compliance: Cutting Through the Confusion for Defense Contractors
CMMC compliance requires more than policies, tools, and checklists. Cheri Hotman and Paula explain how defense contractors should approach CMMC scoping, CUI, NIST 800-171, readiness, evidence, documentation, remediation, assessment preparation, and ongoing program management.
Building Customer Trust in the Digital Age: Why Security and Compliance Drive Revenue
Customer trust is no longer built only through brand reputation, relationships, or a good product. Increasingly, customers want evidence that the organizations they work with can protect data, manage cybersecurity risk, meet compliance obligations, respond to incidents, support accessibility, govern emerging technologies, and operate responsibly. In this Hotman Group session, Cheri Hotman and Sarah discuss […]
CMMC 101: What you need to know from framework to final rule
CMMC requirements have changed significantly since the program was introduced. This updated CMMC 101 guide explains the current Phase I status, CMMC Levels 1–3, FCI and CUI, NIST 800-171, self-assessments, scoping, SPRS, and what defense contractors should do now.
Security Questionnaires: Why You Can’t Just Blame the Intern
Security questionnaires can affect customer trust, sales, contracts, and risk decisions. Cheri Hotman and Caroline McCaffery explain how organizations can improve accuracy, reduce questionnaire fatigue, use automation responsibly, maintain a system of record, and build a scalable customer-assurance process.
Why GRC Maturity Matters: How to Reduce Cognitive Overload and Build a Scalable Program
GRC programs become overwhelming when organizations rely on reactive, manual, and person-dependent processes. Cheri Hotman and Kane explain how a GRC maturity model can reduce cognitive overload, identify weak spots, improve business alignment, and build a more scalable governance, risk, and compliance program.
Internal vs. External Cybersecurity Resources: When to Build, Hire, or Bring in Outside Expertise
Should cybersecurity and GRC work be handled by internal employees or outside experts? For most organizations, the better question is not “internal or external?” but “what mix of ownership, expertise, capacity, and independence does the business need right now?” The strongest cybersecurity and Cyber GRC programs often combine internal knowledge with external specialization so the […]
