Trygg note
Information Security Happens at the Edges
Attackers look for the edge nobody owns.
Trygg. October 22, 2026. This is a Trygg note. The sources are listed at the end.
Join to save this for later.
Email is the edge people already watch
Some edges of the work already have someone watching. Email has filters, training, and phishing tests. The help desk phone, the mailroom, and the vendor who stores your employee's names often have no owner and no place to say what looked wrong. Attackers look for that edge. In 2025 the FBI Internet Crime Complaint Center received more than a million complaints. That volume is the background of the workday, not a rare emergency. Phishing and spoofing was the most reported type, with 191,561 complaints. Business email compromise, the version aimed at a company, was 24,768 complaints and about $3.047 billion in reported losses. That is about a year of pay for 60,000 people. The May 2025 median U.S. wage was $50,980. Email is the edge people already practice for.
The help desk phone is an edge nobody owns
A phone call can get further than a filtered inbox. In the Verizon 2026 Data Breach Investigations Report, phishing simulations showed a median click rate for voice and text about 40% higher than for email. Verizon's sample of those voice and text tests is still small. CISA and the FBI describe a criminal group that targets large companies and the IT help desks those companies contract. Callers pose as employees and talk help desk staff into resetting a password and moving multifactor authentication to a device the caller controls. Details that make the call sound real come from social media, public information, and leaks of other databases. One call sits on two edges: the help desk, and files that already had the employee's name.
The mailroom is an edge nobody owns
On March 6, 2025 the FBI warned businesses about letters delivered to corporate executives, stamped "Time Sensitive Read Immediately." The letters claimed a ransomware group had the company's files and demanded $250,000 to $500,000. The FBI assessed them as a scam and had not identified any connection between the senders and that group. If a letter arrives, the FBI's advice is to make sure defenses are current and that there are no active alerts. A fake letter still triggers a real check. The U.S. Postal Inspection Service is investigating the part of the scam that moved through the mail.
A vendor can be an edge nobody owns
The same Verizon report found a third party involved in 48% of breaches, a 60% increase from the year before, and the human element in 62%. A payroll company, a software vendor, or a contracted help desk can hold names and the reset process. When that relationship has no owner on your side, a leak or a persuasive call has nowhere to land until the account is gone. Choosing a partner you can still see is the subject of Trygg's note on cybersecurity partners.
Reporting the attempt is the control
Someone reports the phish, the letter, or the help desk call that did not match the person. That report puts the event in the open while there is still time to reset the account, warn the person, and give that edge an owner and a way to report the next one.
Trygg keeps the record in the light: every reported event, its owner, the risk it touches, and the fix. What gets reported today makes you stronger tomorrow.
ISO/IEC 27001:2022
An auditor will ask whether people report what they see, whether they have been taught to, whether the organization watches its threat environment, how the help desk checks a caller before it resets a password, and how supplier relationships stay in view.
- A.6.8 Information security event reporting
- A.6.3 Information security awareness, education and training
- A.5.7 Threat intelligence
- A.5.17 Authentication information
- A.5.19 Information security in supplier relationships