Field Guide to the Cybersecurity Apocalypse: awareness training for Minneapolis teams

Cybersecurity awareness training in Minneapolis starts with seven monsters

Picture a Tuesday at a 60 person company off the I-494 corridor. The controller gets an email from the "CEO" asking for a quick wire. Nothing exploded. Nothing ever does, until it does.

That is why cybersecurity awareness training in Minneapolis and across the Twin Cities keeps coming back to people. Your firewall is not the front door. Your team is.

We built this field guide for Cybersecurity Awareness Month, but it works in February just as well. Each monster gets a real name, a threat level, a statistic, how it hunts and three survival moves. Companies with 25 to 500 employees rarely have a training department. A field guide and 20 minutes will do.

Count Phishula and phishing awareness for employees

Real name: phishing. Threat level: five skulls. Count Phishula is charming, well dressed and completely unable to enter unless somebody invites him in. One click is an invitation. He arrives dressed as your bank, your boss or a delivery notice, and asks very nicely for a password, a payment or a quick favor.

According to the Verizon 2026 Data Breach Investigations Report, 62% of breaches involve a person clicking, replying or trusting the wrong message. Phishing was also the most reported cybercrime in America last year, with 191,561 complaints to the FBI.

How to survive him

• Hover over every link before you click it. If the address does not match the sender, it is bait.
• Confirm any money request with a phone call to a number you already have on file.
• Train the team until spotting bait is a reflex: short, regular, with simulated phish that teach instead of shame.

The Ransom Mummy: ransomware protection for small business in Minnesota

Real name: ransomware. Threat level: five skulls. The Ransom Mummy wraps every file you own in layers you cannot undo, then demands tribute to unwrap them. It slips in through a phish or an unpatched system, waits quietly, then locks everything at once. Usually on a weekend.

Verizon's 2026 report found that 48% of all breaches now involve ransomware, up from 44% a year earlier. The median ransom paid was $139,875. The good news: 69% of victims refused to pay, because their backups worked.

How to survive it

1. Keep tested backupsThree copies, two media types, one off site and immutable, so the Mummy cannot wrap the backup too.
2. Put 24/7 detection and response on every deviceRansomware waits before it strikes. A 24/7 security operations center catches the waiting.
3. Write the plan before the bad dayWho calls whom, what gets isolated first, where the printed contact list lives.

Hit on a Friday evening in tax season, contained in 22 minutes, restored from immutable backups overnight, fully operational by Monday.Solution Builders client, 42 user accounting firm

The data backup and disaster recovery team in Bloomington runs the restore tests that make that story possible.

The Botnet Horde and the Vendor Werewolf hunt with borrowed keys

The Botnet Horde. Real name: botnets. Threat level: three skulls. Thousands of hijacked computers, cameras and routers shuffling wherever their master points, and yours could be one of them. The Microsoft Digital Defense Report 2025 found that 97% of identity attacks are password guessing at massive scale. A zombie device usually works fine. Nobody notices it joined.

The Vendor Werewolf. Real name: third party risk. Threat level: four skulls. Looks exactly like a vendor you have trusted for years. Then the moon comes up. Attackers breach a supplier, then stroll into your network with that supplier's keys. Verizon reports that 48% of breaches involved a third party, a 60% jump from the year before.

The Franken System is stitched together from things nobody patched

Real name: unpatched technology. Threat level: four skulls. The Franken System is stitched together from old servers, forgotten laptops and software that stopped getting updates years ago. It is alive. Barely. Every missing patch is an open seam, and attackers do not need to be clever. They just pull the thread.

The Verizon 2026 report found that 31% of breaches begin with an attacker exploiting a known, unpatched flaw. Only 26% of critical known flaws were fully patched last year, and the typical fix took 43 days. Every company in Minnesota has a candidate: the old server at the plant running one application nobody wants to touch.

Proactive patching and lifecycle planning are routine inside a managed IT agreement, which is why Franken Systems are rare among Solution Builders clients.

The Deepfake Shapeshifter: deepfake fraud prevention for finance teams

Real name: AI impersonation. Threat level: four skulls. The Shapeshifter wears your CEO's face and borrows your CFO's voice, because it studied them. It arrives as a video call or a voicemail with an urgent request: wire the money, share the code, and keep it quiet.

The IBM Cost of a Data Breach Report 2026 found that 45% of AI powered attacks use deepfake impersonation of someone the victim trusts, and more than one in four organizations hit by an attack say AI was part of it, up 56% in a year. Deepfake fraud prevention is now a finance team skill.

How to survive it

1. Agree on a safe wordAny request for money, a password or a multifactor code has to include a phrase you agreed on in person. It studied your CEO's voice. It did not sit in your Monday meeting.
2. Call back on a number you already have on fileNot the number in the message. Hang up, look it up, dial it yourself.
3. Slow downUrgency is part of the costume. A real executive can wait ten minutes. A monster cannot.

The Shadow AI Ghost needs a shadow AI policy, not an exorcism

Real name: unapproved AI tools. Threat level: three skulls. The Ghost is friendly, helpful and already inside the building. It is the AI tool nobody approved, quietly reading whatever gets pasted into it. It floats through the walls with your client data, contracts and source code.

IBM's 2026 report found that 43% of organizations had a shadow AI incident this year, up from 20%. These incidents cost more, too: $5.39 million on average, compared with $4.63 million, because nobody knew the data was there.

Banning AI does not work. It only makes people quieter. The moves below replace the ghost with something you can see.

• Write a one page AI policy people will actually read: the approved tools and the data that never goes into a public tool.
• Give the team approved tools, such as Microsoft Copilot inside your own tenant, so they stop hunting for their own.
• Know which data is going where, and who sent it, with no punishment for telling.

The AI consulting practice at Solution Builders starts every engagement with governance before the first prompt. Evolving is the E in RISE, and it only works once the Ghost has been shown the door.

Your survival kit: what to do this week

Twenty one survival moves sounds like a lot. Lay them side by side and a handful stop several monsters at once, and none require a purchase this week.

• Multifactor authentication on every account, which blunts Count Phishula, the Horde and the Werewolf in one move.
• Tested, immutable, off site backups, so the Ransom Mummy has nothing to hold hostage.
• A safe word and a call back rule for every money, password and code request.
• A patch calendar, a device inventory and a one page AI policy.

1. Hold the sightings meetingTwenty minutes, monster by monster, one question each: would we survive this one today?
2. Pick two moves to finish by FridayMultifactor authentication and the safe word are the usual winners. Name an owner and a date.
3. Get an outside readA free discovery session with Solution Builders shows a Twin Cities company which monsters it is open to. Our 24/7 security operations center in Bloomington does not scare easily.

Halloween ends. The monsters stay. To see what a layered defense looks like once the kit is in place, read Part 3: The Solution.