Cyber Security Awareness Month: four habits worth building this October

October is Cyber Security Awareness Month, an annual campaign to help people and organisations stay safer online. It’s a great prompt to talk about security at work. But awareness on its own doesn’t stop attacks. Habits do.

This year, instead of a burst of posters and reminders that fade by November, focus on four simple habits that genuinely reduce risk.

Habit 1: Pause before you click

Most attacks still start with a message: an email, a text, a Teams chat or a social media DM. The single most effective habit anyone can build is to pause when a message creates urgency, pressure or curiosity.

Ask three quick questions:

• Was I expecting this?
• Is it asking me to act quickly, pay something, log in or share information?
• Can I check it another way, such as calling the sender on a number I already know?

A few seconds of hesitation defeats a surprising number of attacks.

Habit 2: Use strong, unique passwords and multi-factor authentication

Reused passwords are one of the main ways attackers get into business accounts. When one website is breached, criminals try the same credentials everywhere else.

Encourage staff to use a password manager so every account has its own strong password, and turn on multi-factor authentication wherever it’s available, especially for email, remote access and financial systems. Where possible, phishing-resistant options such as passkeys or authenticator apps are better than text messages.

Habit 3: Keep devices updated

Updates fix security weaknesses that attackers actively exploit. Delaying them, even by a few days, leaves a window open. Make updates routine on work and personal devices alike, and make sure business systems are patched promptly too.

Habit 4: Report, don’t hide

This is the habit that matters most to security teams. People make mistakes. What turns a mistake into a crisis is silence.

Make reporting easy, for example with a one-click button in your email client, and make it safe. Thank people who report, even when it’s a false alarm. An organisation where staff report quickly will contain incidents far faster than one where people worry about getting into trouble.

Making it stick beyond October

Habits form through repetition. A single month of activity is a great start, but short, regular training and realistic phishing simulations throughout the year are what really change behaviour.

Measure progress, too. Track reporting rates, simulation results and training completion over time so you can see whether your culture is improving.

Ideas to bring the month to life

Awareness campaigns work best when they’re short, relevant and a little bit fun. A few ideas for October:

• Week one: spot the phish. Share real examples (with details removed) of phishing emails your organisation has received, and explain the giveaways.
• Week two: password manager drop-in. Offer short sessions to help people set up a password manager for work and home.
• Week three: update day. Encourage everyone to update their phones, laptops and home routers, and share a simple guide.
• Week four: report and reward. Run a friendly phishing simulation, then recognise teams with the best reporting rates.

Involve leaders visibly. A short message from the managing director about why security matters, or a senior leader sharing a scam they nearly fell for, does more for culture than any poster.

Finally, ask for feedback. What did people find useful? What would they like to learn more about? The answers will help you plan the rest of the year’s training, so the momentum continues long after October ends.