October is Cybersecurity Awareness Month. This year's theme from the National Cybersecurity Alliance is "Don't Make It Easy for Them," and it is aimed at the everyday habits that make attacks harder. CISA is running a parallel theme, "Securing the Next 250," focused on the critical infrastructure the country will depend on. Both point at the same truth: most incidents still start with a person being tricked, not a system being cracked.
The four habits
The Alliance's ask this year comes down to four fundamentals. They are not new, and that is the point:
- Strong, unique passwords with a password manager. Reused passwords turn one breach into many. A manager makes unique passwords effortless.
- Multifactor authentication on everything. An authenticator app or passkey beats SMS codes, which can be intercepted through SIM swapping. But any MFA beats no MFA.
- Keep software updated. Attackers exploit known vulnerabilities fast, and AI is shortening the window between disclosure and exploitation. Patching is a race you win by starting early.
- Recognize and report phishing. Pause before you click, verify through a second channel, and report it so your team sees the pattern.
What AI changed
The habits are the same, but the scams got better. Attackers now use AI-written messages with none of the old telltale grammar mistakes, fake CAPTCHA pages, QR codes that bypass email link scanning, voice calls that sound like real people, and convincing fake sign-in pages. Microsoft detected about 8.3 billion email-based phishing threats in the first quarter of 2026 alone, and QR-code phishing became its fastest-growing vector in that same period.
The defense still works the same way it always has: slow down, verify through a different channel, and assume the message is guilty until proven innocent. AI made the bait more convincing. It did not change what you do about it.
The new front door
Here is the part the four habits do not cover. If your team is adopting AI tools without security guardrails, that is your new front door, and most organizations have not locked it. Controlled intake, data rules for what goes into these tools, identity controls for human and non-human accounts, and baselines that let people move fast without expanding exposure. That is the 2026 version of "don't make it easy for them."
After 17 years in this field, my take is simple: the four habits are the floor, not the ceiling. Do them this month. Then go secure the AI tools.
CISA's Cybersecurity Awareness Month resources: cisa.gov/cybersecurity-awareness-month
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com