Are you a small business owner wondering how to protect your business against scams and cyber attacks?

In this episode of Lost in Cyberia, we are joined by Kimberley Roberts-Salee, Head of Marketing & Communications at Cyber Wardens. Australia's free, government-funded cybersecurity training program for small businesses.

Kim brings a human take to a topic that can feel overwhelming. Coming from a small business marketing background, she's proof that you don't need to be an IT expert to protect yourself online.

We cover:

• The three most common cybercrimes targeting small businesses: inbox break-ins, invoice scams, and online banking fraud
• Why long, strong, unique passwords + multi-factor authentication are still the gold standard
• How cyber criminals are less 'hoodie guy in a basement' and more organised crime empires
• The real cost of a cyber attack: financial, mental, and reputational
• Why the fear approach to cybersecurity doesn't work, and what does
• The surprisingly cybersecurity-savvy world of acupuncturists
• Why your team needs a code word in the age of AI deepfakes
• And the simple habit that could save you thousands: just call and check

Whether you run a small business, work for one, or just want to protect yourself online, this episode gives you practical, jargon-free advice you can use today.

Visit cyberwardens.com.au to access free courses (including foundations, AI safety for small business, and supply chain security).

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals

If financial crime were a country, it would be the third biggest economy after the United States and China.

Iain Russell, threat prevention director at Unphish, joins Annie-Mei and Anika to walk through the shift from awareness to disruption. He talks about how they're using open-source intelligence, pattern matching, and machine learning to take down fraudulent domains, rogue apps, and social media impersonation before any damage is done. Because relying on consumers to spot every threat is just not feasible.

The conversation goes deep on how AI and cheap dark web toolkits have industrialised fraud, lowering the barrier to entry so that almost anyone can run a scam at scale. Iain explains why this isn't just a consumer affairs issue anymore. The money flowing through these pipelines is funding organised crime and, in some cases, destabilising governments.

That brings us to Australia's Scams Prevention Framework (SPF) and why it falls short. With key industry codes still missing, major sectors like superannuation and crypto left out, and no clear roadmap for what comes next, Iain breaks down what good policy could actually look like, and what other countries are already doing that we could learn from.

We need to stop victim blaming people who fall for scams and instead drive change in a world where everyone is expected to operate online.

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals

Why do people click on phishing links? Is it due to lack of awareness training? Is it lack of interest in securing their organisation? And what happens when AI agents, cognitive warfare, and weaponised ambiguity enter the picture?

We chat with Dr. Matt Canham who is the director of the Cognitive Security Institute, former cybercrime investigator with the U.S. Department of Justice, and one of the leading voices in behavioural cybersecurity.

Dr. Canham shares his research on 'repeat clickers'. This is the small percentage of users (around 3–5%) responsible for nearly half of all simulated phishing incidents. Crucially, it's not ignorance. These people know the policies. So what's actually going wrong, and how do we fix it? The answer involves training the brain's fast, automatic responses rather than relying on conscious decision-making.

The conversation then expands into the territory of AI agents as a new attack surface, the emerging field of neurosecurity, and cognitive warfare. If you're not sure what cognitive warfare is we explain how it's the disruption of decision-making as a strategic weapon. Dr. Canham also introduces the concept of ASID attacks, which exploit narrative and ambiguity rather than software vulnerabilities.

Plus, details on the first-ever Cognitive Security Conference, coming to Las Vegas this August.

Cognitive Security Institute:
https://www.cognitivesecurityinstitute.org/

Cognitive Security Institute Conference tickets:
https://www.cognitivesecurityinstitute.org/cognitive-security-conference

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals

The best thing about attending events around the world is the people you meet. Annie-Mei met Jadon at a DEFCON after-party in 2025, where Jadon was struggling to get the bartender's attention for a beer. Nothing bonds people like needing a cold beverage. Jadon is the founder of New York-based Maro, a tool he describes as a security buddy that helps employees actually follow policy. Maro is a cute flame character that intervenes in real time when someone's about to paste sensitive data into an unapproved AI tool or fall for a social engineering attack.

Jadon took an unusual path to cybersecurity. At Yale, he studied books so that he'd be able to understand what people were talking about at cocktail parties (which, to be fair, is a useful skill to have) but then he ended up going down the computer science path. He got the attention of a salesperson who he cold contacted and managed to get an internship at Threat Stack.

The three of us discussed a lot of topics including AI regulation, sovereign AI, cognitive security and so much more. Make sure you endorse Jadon for 'tequila' on LinkedIn!

Jadon’s LinkedIn:

https://www.linkedin.com/in/jadoncm?utm_source=share_via&utm_content=profile&utm_medium=member_ios

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals

When life gets overwhelming, more and more people are turning to AI chatbots for emotional support, and it's not hard to see why. Traditional therapy remains out of reach for many due to cost, stigma, and availability. But what happens when the tool you're leaning on was never designed to hold that weight?

In this episode, we chat to Dr. Rachel Wood. She's a cyber psychology PhD and founder of the AI Mental Health Collective. Dr. Wood helps us untangle the growing relationship between artificial intelligence and our emotional lives. She explains the difference between the general-purpose 'omnibots' millions use daily and the clinically grounded, human-supervised tools actually built for mental health support. The difference, she argues, matters more than most people realise.

We explore how AI can be genuinely useful as a rehearsal space. A low-stakes environment to practise empathy, work through difficult conversations, and build social confidence. But we can't rely on it too heavily because that comes with costs like cognitive offloading, emotional dependency, eroded critical thinking, and the subtle but significant loss of what she calls 'failure and repair' in human relationships.

We also get into the design choices that either protect or endanger users, and why sharing your most sensitive emotional data with an AI platform carries real privacy risks.

The takeaway? AI is going to continue to be used but it'll never fully replace other forms of mental health support. As Dr. Wood puts it, nothing protects us from over-dependence on technology quite like investing in high-quality human connection.

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals

Policy. Diplomacy. Cyber. Three words guaranteed to clear a room (or so you'd think).

But cyber diplomacy matters and we provide real-world examples like the 2007 cyber attacks on Estonia, the Medibank breach and Australia slapping sanctions on Russian hackers and the infamous Stuxnet worm.

In this episode we break down what cyber diplomacy is, why it matters and what Australia is actually doing to strengthen ties across the Indo-Pacific (with a healthy dose of Mean Girls references and Harry Potter nostalgia thrown in).

(P.S. Anika called it 3 Days in Mariupol - it's 20 Days in Mariupol. Still haunting either way)

Australian Volunteers Program:

https://www.australianvolunteers.com/

20 Days In Mariupol:

https://www.theguardian.com/film/2024/mar/11/20-days-in-mariupol-documentary-oscar

Why is it called the Quad?

https://www.aspistrategist.org.au/the-real-significance-of-the-quad/

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals

Imagine this, you're in your kitchen baking a cake and someone calls you from crypto.com saying they're from the security team and that there's been suspicious activity on your account. You are a crypto.com customer so this sounds pretty legitimate. But turns out it's not. It's just a scammer pretending to be from crypto.com.

This is what happened to Stephen. He received a call from a US number. The caller directed him to a convincing lookalike site (a hyphenated domain), pressured him with urgency, and prompted him to enter his app PIN and a 2FA code, plus delete the legitimate app and download another wallet app.

Everyone thinks that they wouldn't fall for a scam. But scammers use psychological tactics to get us when our guard is down. We loved Stephen sharing his story with us and we need to normalise talking about scamming because we are all vulnerable due to living in the digital world.

If you are know someone who you’re concerned could fall for a crypto scam, make sure you share this episode with them.

If you'd like to share your own scam story, please get in contact with us.

Report a scam:

https://www.scamwatch.gov.au/report-a-scam

Report identity theft:

https://www.idcare.org/

Our Scam Stories:

https://www.linkedin.com/posts/ourscamstories_i-thought-i-was-immune-to-scams-i-felt-activity-7439816758481502208-wuI1?utm_source=share&utm_medium=member_ios&rcm=ACoAABXP9DgBP6Ry-lt82_LL0JIly0YXzrG4z3o

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals

In this episode, we are joined by Sam Brazier-Hollins, Head of Technical Consulting at Fujitsu (also Annie-Mei's former manager). We got so into the convo straight away that we forgot to get Sam to actually introduce himself properly. But you can look him up on LinkedIn.

We discuss Sam's recent work trip to New Zealand for the Digital Workplace Conference discussing Microsoft 365 security and AI adoption alongside change management. Sam also reflects on balancing cybersecurity work with having a three-month-old daughter.

Not sure what data you should be sharing with AI? This episode covers everything about privacy issues, data retention, bias, hallucinations and bots chatting to other bots.

We discuss when AI is useful (eg. taking meeting notes) and when it’s not.

If you’re in the consulting space, you’ll find this episode useful for providing tips on how to successfully roll out Microsoft Copilot. Sam is a Microsoft MVP, with the ‘P’ standing for Professional.

We also talk about the importance of taking time offline in an age where it feels like we’re constantly online. Sam and Annie-Mei love to cook, while Anika loves reading tarot cards. Can you tell we're all 30-something millennials?

Sam Brazier-Hollins:

https://www.linkedin.com/in/sam-brazier-hollins/

Send us Fan Mail

Find us on Instagram, YouTube or LinkedIn @thecybersecuritygals