This case explores the challenges faced by the University of Virginia (UVA) in defending against sophisticated social engineering cyberattacks. Despite proactive measures, UVA Chief Information Security Officer Jason Belford and his team grapple with evolving threats that exploit human vulnerabilities. The case examines the university’s cybersecurity landscape, detailing the methods used by cybercriminals and the institution’s response strategies, including phishing training and awareness programs. Students are tasked with analyzing the data from phishing simulations and developing new initiatives to foster a culture of resilience. The case provides a platform for discussing the complexities of cybersecurity in large institutions and the critical importance of organizational awareness and proactive defense mechanisms.