Don't make it easy for them: four habits for Cybersecurity Awareness Month
Most attacks on small businesses do not depend on anything clever. They depend on an opening someone left easy. This year's Cybersecurity Awareness Month theme is about closing the easy ones, and none of them require a big budget.
The people trying to get into business accounts are, for the most part, looking for the path of least resistance.
The Cybersecurity and Infrastructure Security Agency says it plainly in its own guidance: online criminals go after easy targets, the people who skip basic precautions. Take the basics seriously and you stop being the easy target. That is the whole idea behind this year's Cybersecurity Awareness Month.
What this October is about
October has been Cybersecurity Awareness Month since 2004. It is run jointly by CISA and the National Cybersecurity Alliance, and in 2026 each picked its own theme. CISA's is "Securing the Next 250," a nod to the country's 250th year. The Alliance went with "Don't Make It Easy for Them."
The second one is the more useful for a small business, because it points at something you control. You cannot stop someone from sending a phishing email. You can make sure that when they do, the email lands somewhere it will not work.
Both themes come back to the same four habits CISA has promoted for years through its Secure Our World program. They are worth taking one at a time.
Turn on multifactor authentication
Multifactor authentication (MFA) means a password alone is not enough to get into an account. Someone also needs a code from an app, a prompt on a phone or a physical key. A stolen password becomes much less useful when it only opens half the door.
Start with email, because email is where password resets go. Then move to banking, payroll and anything holding customer information. CISA recommends authenticator apps or hardware keys over text-message codes where the service offers them.
This week Confirm MFA is on for every email account in the business, including the ones that rarely get used.
Use strong, unique passwords and a password manager
A strong password is long, random and used for one account only. Reuse is the real problem. When one website is breached, attackers try that same email and password everywhere else.
Nobody can remember dozens of long, random passwords, which is exactly why a password manager exists. A business password manager also solves a quieter problem: shared logins that live in a spreadsheet, a notebook or on a sticky note under the keyboard.
This week Ask where shared passwords are kept today. If the honest answer is a spreadsheet, that is your first project.
Recognize and report phishing
Phishing is still the most common way in, by email, text or phone call. The tells are familiar: urgency, an unexpected attachment, a request to log in or a change to payment details. Some are much harder to spot. We recently walked through a "confidential document" email built to take over a Microsoft 365 account that never asked for a password at all.
The fix is a habit, not a talent. When a request involves money, credentials or sensitive information, verify it through a channel you already trust, like a phone number you have on file rather than the one in the message. And make reporting easy, so the person who spots something odd says so instead of quietly deleting it.
This week Tell your team exactly who to forward a suspicious email to, and thank the first person who does.
Update software
Updates close the flaws attackers use to get into files and accounts. Developers fix those flaws as fast as they can, but the fix only helps once it is installed. That applies to computers and phones, and also to browsers, the firewall and the Wi-Fi equipment in the back room.
It also applies to machines that can no longer get updates at all. If your office still has Windows 10 computers, our post on what Windows 10 Extended Security Updates cost walks through how to decide what to do with each one.
This week Restart any computer that has not been restarted in a week. Many updates wait for it.
The part that makes it stick
Habits work best when they are the default
Awareness months are good at reminding people. They are less good at changing what happens on an ordinary Tuesday in March. The businesses that get lasting value from these four habits stop relying on everyone remembering them.
MFA is required by a setting, not a memo. Updates install automatically. The password manager is simply where logins live. When the safe option is also the easy one, the habit takes care of itself.
A short check you can run this week
- Check MFA on every email account. Including former employees' accounts that were never closed, and shared inboxes like info@ or billing@.
- Find where shared passwords live. If they are in a document or on paper, plan the move to a password manager.
- Name the person who handles suspicious emails. Tell the team, and make it clear nobody gets in trouble for asking.
- Look for anything that cannot update. Old computers, an aging firewall, a router nobody has logged into in years. Put them on a list with dates.
None of this is dramatic, and that is the point. Attackers count on predictable gaps. Closing four of the most common ones is one of the best returns on an afternoon a small business can get.
Sources: CISA Cybersecurity Awareness Month, CISA Secure Our World and CISA guidance on multifactor authentication. The 2026 campaign themes are from CISA and the National Cybersecurity Alliance.
Want a second set of eyes?
If you are not sure whether MFA is on for every account, or which machines have fallen behind on updates, we will check with you and tell you plainly what we find. If you are already in good shape, we will say so.
Prefer to talk it through? Email support@systech.io or call 541.696.5555, Option 1.
Keep reading
More from the blog
-
Security alert
Device code phishing: how a "confidential document" email tries to take over your Microsoft 365 account
A phishing email built to take over an account without ever asking for a password.
-
IT planning
Small business IT budget: what to include and how to plan it
Support, security, renewals and the costs that usually get left out.
-
IT planning
How long business computers last and when to replace them
Three to five years is a planning range, not an expiration date.