You don't need a zero-day exploit to hack a Fortune 500 company—you just need a phone and a story. In this video, Sec Guy breaks down the MGM Resorts Breach, explaining how attackers used Vishing to trick a help desk into resetting credentials. We also cover the rise of AI Deepfakes in CEO Fraud, why Tailgating works because of human courtesy, and how Business Email Compromise (BEC) stole $100M from Facebook and Google.

New Security+ SYO-801 Study Guide Available today: secguy.org/security-study-guide

[Exam Ready Route - FREE]

Pass your certification for $0.

✅ Training Videos & Practice Tests

✅ Sec Guy Mobile Lab (On-the-go training powered by AI voice)

✅ Discord Access (Study sessions & Industry networking)

👉 Start Here: https://secguy.org

[Job Ready Route - MEMBERSHIP]

Stop studying and start working. Get the hands-on experience hiring managers are asking for.

🔥 Hands-On Labs: Python, Encryption, Hashing, AI, & CTFs

🔥 Salary Negotiator Workshop

🔥 Experience Builder: Real-world projects to fill your resume

👉 Get Hired: https://secguy.org

[Exam Domain Checklist]

This video covers critical objectives for the following exams:

Security+

[ ] Domain 2.4: Social Engineering (Phishing, Vishing, Smishing, BEC, Pretexting)

[ ] Domain 2.1: Threat Actors (Motivation: Financial vs. Chaos)

CISSP

[ ] Domain 1: Security and Risk Management (Social Engineering Training & Awareness)

[ ] Domain 7: Security Operations (Physical Security: Tailgating & Piggybacking)

CISM

[ ] Domain 3: Information Security Program (Human Firewall & Security Culture)

CRISC

[ ] Domain 2: IT Risk Assessment (Human Element Risks)

CCSP

[ ] Domain 1: Cloud Concepts (Social Engineering Cloud Admins)

SecurityX (CompTIA)

[ ] Domain 3.0: Security Operations (Analyzing Social Engineering Campaigns)

GIAC GSEC (SANS)

[ ] Social Engineering: Principles of Persuasion (Authority, Consensus, Urgency)

AWS CSS (Certified Security – Specialty)

[ ] Domain 1: Threat Detection (Identifying Compromised Credentials via Phishing)

Pentest+ (CompTIA)

[ ] Domain 3: Attacks and Exploits (Social Engineering: Pretexting & Elicitation)

[ ] Domain 1: Planning and Scoping (Physical Assessments: Tailgating)

CEH (Certified Ethical Hacker)

[ ] Domain 9: Social Engineering (Types, Phases, & Countermeasures)

SecAI+

[ ] AI Security: Deepfake Audio & Synthetic Voice Attacks (Vishing)

[Timestamps]

0:00 - Intro: Hacking Humans, Not Hardware

0:22 - Case Study: MGM Resorts (Vishing the Help Desk)

1:08 - AI Threats: Synthetic Voice & Deepfake CEO Fraud

1:40 - Physical Security: Tailgating & Piggybacking (The Pizza Trick)

2:03 - Reconnaissance: Dumpster Diving for Intel

2:30 - Business Email Compromise (BEC): The $100M Invoice Scam

3:13 - Defense: Out-of-Band Verification

3:30 - Summary: The Human Firewall

3:50 - Outro: Stay Safe, Stay Secure.

Original Sec Guy video: https://www.youtube.com/watch?v=VKcS9eeH4Ys