Cybersecurity Awareness Month, 2026

I've been kinda, well, AWOL for cybersecurity awareness month this year. We're half way through the month and I think I've made 2 whole posts to the socials about it. Part of the issue is that I don't feel I have much new to say, and I'm a bit tired of repeating the same old stuff over and over. (If you want that I suggest you simply reread this site's posts, because I still think they're all valid, even if a few are slightly dated)

Is This Making a Difference?

So Cybersecurity Awareness Month is supposed to be about...well, what? I assume by now you're aware of cybersecurity, this isn't some shocking new concept. We're also not out there promoting donations for cybersecurity the way people do for various cancer awareness months,and nobody got dressed up to ring a bell for donations outside the doors of your local supermarket. Nor are we generally running cybersecurity ads on the various entertainment channels you have, but I could picture a few, couldn't you?

So perhaps we're just doing an extra special level of phishing training this month? Is this the month everybody has to attest to all the company cyber-related governance policies? Are we all attending cybersecurity conferences this month? Listening to guest cybersecurity speakers at the company all-hands this month?

For the most part we seem to be repeating the same old stuff over and over:

• Make good passwords
• Don't fall for the phishing/vishing/smishing attack
• Use MFA
• Stay vigilent
• Smash your cell phone to bits every night and get a new one every morning

(Yeah, that last one was to see if you were reading or just skimming)

Are we helping you internalize these messages? Are you, average Jane/Joe SixPack, getting smarter about cybersecurity through this month's activities?

I don't think you/we are.

Doomed To Repeat History

Pick up anybody's annual "breaches we helped respond to" report and you'll see the same things every time:

• Single factor authentication with a "communal" password
• Single factor authentication with a "weak" password
• Unsupported software on the Internet facing attack surface (care to check on how many Windows NT through Windows 10 systems are still Internet accessible?)
• Unpatched software on the Internet facing attack surface (of those, more than 14% of exploited vulns are more than 5 years old)
• and so on.

It's enough to make you think that we're either shouting into the void or just doing this for our own health - and believe me, it isn't healthy. I'm willing to bet you could Google ask your favorite LLM to find you publicly announced examples of each of these from the past 3 months alone.

Should we go further and take a look at how many "network and security" vendors have had to issue CVE's for directory traversal vulnerabilities in their products the past 12 months? (Trend Micro, Ubiquiti, IBM, Microsoft, Cisco, Schneider Electric...)

Cybersecurity Awareness Action Month

I'd like to propose we rename Cybersecurity Awareness Month to Cybersecurity Action Month. And let's take some concrete actions as individuals - we'll let the corporations be responsible for their own stuff:

Check to see if your email address(es) has(have) been found in recent breaches and change your passwords!

Have I Been Pwned is a great resource for identifying if your login information was compromised. If you find your email address in there, make sure you check in on the account that was breached, and change your password for that account and any others that you used the same password for.

If you want to take this further, get yourself a password manager and start migrating your accounts to generated passwords. Even better, start adding 2-factor authentication to every account you can.

Delete apps from your phone that you can just as easily use from the browser.

Apps offer a wider opportunity for tracking on mobile devices than websites do, so working from the premise that a company can't lose what it doesn't have reducing the data they have about you is a cybersecurity win. That isn't to say that websites can't track you on your phone, but they have fewer options than the apps do. Oh, and I'll suggest changing your default phone browser to something like DuckDuckGo's mobile browser for added privacy.

Update or replace your unsupported hardware

That old laptop running Windows 10 needs to be updated, either to Windows 11 or to Linux. Your old firewall needs to be updated - and if it doesn't get automatic updates replace it ASAP. Your old Android phone needs to be put out to pasture. I know, this all costs money, but start with the pieces you can do for free (Linux on the laptop is a great start) and keep moving from there.

There. That's three actionable things you can do right now to improve your own cybersecurity. And if you really want to think about improving cybersecurity for your organization, well, you could do worse than starting with these thoughts:

Bill's Top 10 Rules For Minimizing a Breach

No, this list isn't from the home office in Wahoo, Nebraska. No, Paul Schaffer won't have the band doing musical stings after you read each of these. But if you have any actual interest in minimizing the impact of a breach to your organization (or your home), this

Between Two FirewallsBill Bernard

The Biggest Key to Cybersecurity Success - Consistency

Consistency. A simple concept but a significant factor in ensuring your organization's cybersecurity program is successful.

Between Two FirewallsBill Bernard

Axioms for Any Cybersecurity Program

There are some universal truths that apply to any cybersecurity program, be they for your home environment or the largest enterprises in the world.

Between Two FirewallsBill Bernard

Happy Cybersecurity Action Month!