Every October, governments and security bodies in the US, Canada, Europe and India run awareness campaigns, and every October most companies respond with a phishing simulation and a poster. Both have their place. Neither touches the reasons most organisations actually get breached.
This year's campaigns are sharper than usual, and two of them speak directly to organisations rather than individuals. Here is what they ask for, what that looks like inside a company, and where the month's message stops being enough.
What the 2026 campaigns are asking for
The campaigns differ in tone but agree on substance.
United States: "Don't Make It Easy for Them"
The National Cybersecurity Alliance, which co-leads the month with CISA, has moved away from the gentler "Secure Our World" framing of recent years. Its 2026 message is blunter: most attacks succeed because the target made it easy, and the fix is a small set of habits repeated consistently.
United States: "Securing the Next 250"
CISA has tied its 2026 campaign to the country's 250th anniversary and aimed it at critical infrastructure and the suppliers that support it, under three organisational actions: Reduce, Replace and Recover.
Canada: "Your best defence is you"
Get Cyber Safe, run by the Communications Security Establishment with the Canadian Centre for Cyber Security, organises the month into four weeks: recognising threats, strengthening defences with passwords and multi-factor authentication, protecting information online, and building a community that shares and reports what it sees. Its message this year is that AI makes scams more convincing, while the basic habits still work.
Europe: the workplace
European Cybersecurity Month, coordinated by ENISA and now in its fourteenth year, focuses on awareness and preparedness at work: phishing, fraud, ransomware and AI-enabled scams that land in employees' inboxes rather than at home.
India: National Cybersecurity Awareness Month
CERT-In observes October as National Cybersecurity Awareness Month each year, with guidance for citizens and organisations alongside the advisories it issues throughout the year.
The four habits, and what they look like at work
The individual advice is consistent across every campaign: strong passwords with a password manager, multi-factor authentication, recognising and reporting scams, and keeping software updated. Each one has an organisational version, and that version is where the habit either sticks or quietly dies.
Passwords and a password manager
Telling staff to use unique passwords achieves little if the company does not provide a managed password vault, and less if shared accounts still exist for finance systems, supplier portals or social media. The organisational step is to issue the tool, remove the shared logins, and make single sign-on the default for anything that supports it.
Multi-factor authentication
Most organisations have MFA. Fewer have it on every account that matters, including administrators, service desks, remote access and email. Fewer still have moved high-risk accounts to phishing-resistant methods such as authenticator apps with number matching or hardware keys, rather than SMS codes that can be intercepted or approved by a tired user at the wrong moment.
Recognising and reporting scams
The weak point is usually reporting, not recognising. If reporting a suspicious email means finding an address and writing a message, most people delete it instead, and the security team never learns that the same message reached forty inboxes. One report button, a fast acknowledgement and no blame for the person who clicked are what make reporting a habit.
Keeping software updated
At home this is an automatic update. At work it is a patch cycle with rings, a deadline for critical fixes, and an honest list of the systems that cannot be patched because a vendor or an application holds them back. The list matters more than the cycle: it is where the exposure lives.
CISA's three Rs, for any organisation
CISA aimed Reduce, Replace and Recover at critical infrastructure, but the framing works for any company with systems it cannot afford to lose.
Reduce
Shrink what an attacker can reach. That means patching promptly, closing services exposed to the internet that nobody uses, removing dormant accounts and standing administrator rights, and segmenting the network so one compromised laptop is not a route to everything.
Replace
Retire software and devices that have reached end of life before they become the permanent exception. Every estate has a server nobody wants to touch and a firewall past its support date. Naming them, with a replacement date and an owner, turns an unspoken risk into a plan.
Recover
Assume something will get through and make sure the business can keep running. Backups held where an attacker with administrator access cannot delete them, restores tested rather than assumed, and a response plan that leadership has walked through at least once before it is needed.
What awareness cannot fix
Awareness campaigns are aimed at people because people are where an attack usually starts. But training an employee to spot a phishing email does nothing about what happens after the one email that gets through. Four gaps come up in almost every assessment we carry out, and none of them is a training problem.
Too much access
Accounts that hold far more privilege than the job needs, leavers whose access was never fully removed, and service accounts with administrator rights and passwords that have not changed in years. A convincing phishing email is a nuisance against a well-scoped account and a disaster against an over-privileged one.
Suppliers with standing access
Managed service providers, software vendors and contractors frequently hold remote access that is always on, rarely reviewed and outside the company's own monitoring. CISA's focus on the supply chain this year is a direct response to that pattern.
Backups nobody has restored
A backup that has never been restored is an assumption, not a recovery plan. Ransomware groups look for backups first, and the restore that takes four days instead of four hours is usually discovered during the incident.
No decision on who decides
The first hours of a real incident are lost to questions about authority: who can disconnect a site, who calls the insurer, who speaks to customers and regulators. Those questions have answers that can be written down in advance, and they are almost never answered by an awareness campaign.
These sit in the programme layer: the risk register, the access model, supplier oversight and incident readiness. That is the work our cybersecurity practice does, with the controls themselves run under Managed Security Services.
A checklist for October that outlasts October
If you do one thing for each habit and each R this month, choose the version that keeps running after the campaign ends.
Turn on MFA everywhere it is missing
List every account without it, starting with administrators, email, remote access and the service desk. Move administrators to a phishing-resistant method.
Make reporting a single click
Add a report button to email, acknowledge every report, and publish one example a month of a real message someone caught.
Run an access review
Remove dormant accounts, standing administrator rights nobody can justify, and supplier access with no current contract behind it.
Name the unpatchable
Write down every system that cannot be patched or is past end of life, with an owner and a replacement date.
Restore something
Pick one critical system and restore it from backup into an isolated environment. Time it. The number you get is your real recovery time.
Hold a one-hour tabletop
Put leadership in a room with a ransomware scenario based on your own systems and ask who decides what. Write the answers down.
None of these needs a new product. All of them make the company harder to attack, which is the whole of this year's message.