Cybersecurity Awareness Month: A Four-Week Plan

Every October the security industry produces a great deal of noise and most small businesses take away nothing from it, because the advice arrives as a hundred things to do at once and lands on people who already have jobs.

So here is the opposite: four weeks, one topic each, twenty minutes a week. It is designed for a team of five to fifty with no security staff, and each week ends with something you can actually check rather than something you are told to be aware of.

Cybersecurity Awareness Month runs every October and is co-led by CISA and the National Cybersecurity Alliance. This year’s theme is “Don’t Make It Easy for Them”, which is the right instinct: almost nothing below stops a determined, targeted attacker, and almost all of it stops the automated, opportunistic attacks that make up the overwhelming majority of what small businesses face.

Key takeaways:

• One topic a week beats an annual hour-long session nobody remembers by November.
• Each week should end in a verifiable change, not a feeling of awareness.
• Do it in a normal team meeting. Booking a special session is how this gets postponed to never.
• Write down what you changed. It is the evidence an insurer or a client will ask for later.

Week one: passwords, and the ones that already leaked

Twenty minutes. Start with the uncomfortable, concrete thing rather than the theory.

Have everyone check whether a password they actually use has already appeared in a breach. Our breached password checker does this without the password leaving the browser, and the moment somebody’s does come back as leaked, the abstract topic becomes real for the whole room.

Then the change: a password manager, with a unique password per account. Not “make your passwords stronger”, which asks people to do an impossible memory task. The manager is the thing that makes uniqueness achievable, and uniqueness is what stops someone else’s breach from becoming yours. If people want better passwords for the handful they must remember, the passphrase generator makes ones that are both strong and typeable.

Done when: every person has a password manager and their email password is unique.

Week two: turn on the second lock, properly

Multi-factor authentication is the single highest-value control on this list, and most businesses have it half-deployed: on email, and nowhere else.

This week, walk the list of what would actually hurt. Remote access. The accounting system. Payroll. The bank. The domain registrar, which deserves special attention because whoever controls it can redirect your email and your website. And the password manager you set up last week.

While you are in there, check what kind of MFA you are using. If your approvals are a plain “approve or deny” tap, that is the version attackers defeat by sending prompts at 2 a.m. until someone taps to make it stop. Not all MFA is equal covers the ladder and which rung to aim for.

Done when: MFA is on for every account that touches money, client data, or your domain.

Week three: phishing, without the folklore

Retire the old advice first. “Watch for bad spelling” is no longer a reliable tell, because the tools attackers use now write perfectly well.

Replace it with something that still works: verify the request, not the message. Any payment, any change of bank details, any urgent transfer gets a phone call to a number you already had on file. Never the number in the email.

Then make it concrete. Run the Spot the Phish quiz as a group, on a screen, arguing about the answers. Ten minutes, no signup, and the disagreements are where the learning happens. If your team handles invoices, read how business email compromise actually runs together, because seeing the whole sequence is what makes people cautious at the right moment rather than permanently anxious.

Finish by saying out loud that nobody will ever be in trouble for double-checking a request, including one that appears to come from you. Without that, the policy loses to social pressure every time.

Done when: the callback rule is written down, and everyone knows refusing is safe.

Week four: the updates nobody is doing

Least glamorous, quietly important. Most successful break-ins use a flaw that already had a fix available.

Turn on automatic updates everywhere you can. Then find the things that automatic updates do not cover: the router or firewall firmware nobody has logged into since it was installed, the line-of-business application that updates manually, the machine in the corner running something the vendor stopped supporting. That last category is the one worth listing rather than fixing this week, because an unsupported machine is a decision, not a task.

Done when: automatic updates are on, and you have a written list of what cannot be updated and why.

What to do with November

Four weeks in, you have done more than most businesses your size. The part that decides whether it lasts is what happens next.

Write down what changed, with dates. Two paragraphs is plenty. That record is what answers the question when a client sends a security questionnaire or an insurer asks what you have in place, and reconstructing it a year later is far harder than writing it now.

Then put one thing in the calendar: a quarterly fifteen minutes to re-check that MFA is still on everywhere and that new starters got the same setup. Controls drift. Nothing here stays done on its own.

Everything above is genuinely doable in-house, and if you finish October having done it, you have earned the month. What does not fit in twenty minutes a week is the ongoing part: the monitoring, the patching of things that fight back, the evidence that stays current. That is what our managed clients hand over, along with the security controls behind it.

If you would rather know where you stand before you start, a free assessment tells you which of these four weeks you can skip. Or email hello@cohesivesecurity.com and we will send you the one-page version to run yourself.