Every October the same thing happens. Feeds fill up with security tips, brands publish their carousel about passwords, and when the month ends, nothing has changed inside companies. It’s not that the tips are wrong. It’s that they almost never reach the people who need them, who aren’t reading cybersecurity blogs on a Tuesday morning.
October is Cybersecurity Awareness Month, a campaign that the National Cybersecurity Alliance and CISA have promoted since 2004 and that companies and governments around the world take part in. I’ve spent several years watching it go by from the marketing side, and I came away with an uncomfortable conclusion: what’s missing isn’t content. What’s missing is someone on the inside to send it.
Why doesn’t the hallway poster work?
A security vendor is remarkably easy to ignore. Your direct manager is not. When the reminder comes from the person you work with every day, through the channel you already use to talk, it stops being advertising and becomes an instruction.
The other thing we learned is about quantity. If you ask your team for twenty things, they do none. If you ask for five, they do three. And with three, we’re already better off than in September.
The five habits worth asking for
None of them costs money, none requires the person to know about technology, and all five address the door through which most incidents get in today, which is identity, not the firewall.
1. A second factor on work email, and never approve what you didn’t request. The multi-factor authentication is still the measure that stops the most attacks for how little it costs to put in place. With a warning almost no one gives: if you get a notification to approve a sign-in you didn’t initiate, don’t approve it just to make it stop. That notification means someone already has your password, and that’s how two-factor authentication gets bypassed.
2. A password that isn’t reused on any other site. Your work email password is the master key: almost all the others can be recovered with it. Making it long and unique matters much more than odd symbols. And it’s worth saying, because there are still policies that require it: NIST advises against forcing a change every so many months and only calls for a change when there are signs it was leaked. Changing on a calendar produces worse passwords, with a number at the end that goes up one at a time.
3. Look at the full address, not the name that appears. The sender’s name is written by whoever sends the email, so they can put your director’s name in it with no effort at all. The real address is the one that can’t be spoofed so easily. It takes a second of attention and rules out a good share of the phishing attempts that arrive every day.
4. If the message rushes you, be suspicious. Urgency is not a detail of fraud; it is the main tool. No one checks carefully when they’re told the payment will fail in ten minutes or that the director is in a meeting and needs the transfer right now. The rule is simple: when something is urgent and also involves money or credentials, it gets verified through another channel. A thirty-second call to the usual number.
5. Speak up, even if it’s embarrassing. This is the only one of the five that depends not on the employee but on you. In a company where whoever falls for something also gets reprimanded, no one ever reports again, and the incident is discovered three weeks later the expensive way. Ten minutes of embarrassment save weeks of recovery. Say it yourself, out loud, before it’s needed.
And when October is over?
This is the part where most campaigns fall apart. The month ends, the poster comes off the wall and the company goes back to where it was. If you’re only going to do one more thing, make it repeating these five points in January. Awareness works through persistence, not intensity.
To copy and paste into an email to your team
Subject: five things I’m asking of you this month
October is cybersecurity month, and instead of sending you a course, I’m asking you for five concrete things:
1. Turn on the second factor on your work email. If you get an approval you didn’t request, reject it and let us know.
2. Don’t use your work email password on any other site.
3. Before clicking, look at the sender’s full address, not the name.
4. If a message rushes you about a payment or a password, verify it by phone before doing anything.
5. If you think you fell for something, let me know right away. No blame. The sooner we know, the less it costs.
Thank you.
If, while reading the list, you realized you don’t know where your company stands on these points, that is exactly the work we do in the no-cost security assessment: we look, tell you what is in place and what is missing, with no invoice involved.
Awareness is the only control you can’t buy. You have to ask for it.
