Manage
Cybersecurity Awareness Month rolls around every October, and every November the same thing happens: the webinars end, the posters come down, and the good intentions go back in a drawer.
If you missed it this year — or skimmed a couple of LinkedIn posts and moved on — relax. You didn’t miss anything complicated. The whole point of Cybersecurity Awareness Month is that the boring basics still stop the majority of attacks aimed at small businesses. Not a bigger budget. Not another dashboard. The basics.
Here’s the short version of what you should have taken away, why each item matters, and what to do about it now.
Cybersecurity Awareness Month Isn’t Really About October
Attackers don’t work off a calendar. The phishing email that lands in your bookkeeper’s inbox next Tuesday doesn’t know that awareness season ended. We treat Cybersecurity Awareness Month as an annual prompt to re-check the fundamentals — not a 31-day campaign with a finish line.
Cybersecurity Awareness Month is a joint effort between CISA and the National Cybersecurity Alliance, and the themes barely change year to year: passwords, MFA, phishing, updates. That repetition isn’t lazy. It’s because those four things are where small businesses keep getting hurt.
The six items below are the ones we walk clients through most often. None of them need a project plan. Most take an afternoon.
6 Cybersecurity Awareness Month Habits Worth Keeping All Year
1. Use Long, Unique Passwords — and a Password Manager
Weak and reused passwords are still the easiest way into a business. One breached password on a personal shopping site becomes the key to your email if you reused it. Long passphrases, one per account, stored in a password manager your team will actually use. That’s it.
2. Turn On Multi-Factor Authentication Everywhere You Can
Multi-factor authentication (MFA) is the single highest-value item on this list. Even if a password leaks, MFA blocks the login. Start with email, banking, remote access, and your line-of-business apps — then work outward.
3. Get Genuinely Good at Spotting Phishing
Phishing is still how most incidents begin, and it has gotten far more convincing now that attackers use AI to write the copy and clone login pages that can defeat MFA. Slow down on anything unexpected that asks for credentials, payment details, or urgency. Hover before you click. When in doubt, verify by phone using a number you already had.
4. Stop Postponing Updates
Most breaches exploit something that was patched months ago. Operating systems, browsers, plugins, firmware — if there’s a “remind me later” button you keep pressing, that’s your gap. Automate patching so it stops being a decision.
5. Back Up Like You’ll Actually Need It
Backups are what turn a ransomware event into an inconvenience instead of a closure. Keep more than one copy, keep one of them off your network, and — this is the part people skip — test a restore. An untested backup is a guess.
6. Secure Every Device, Not Just the Office Ones
Laptops, phones, and tablets all touch your business data. Each one needs current endpoint protection, a firewall, disk encryption, and a screen lock. If a device can open your email, it belongs in your security plan.
The Cybersecurity Awareness Month Gaps We See Most in New Jersey
Across the NJ, NY, and PA businesses we support, the pattern is almost always the same. MFA is switched on for email but not for remote access. Backups run but have never been restored. One admin account is shared by three people. And nobody actually owns security, so it quietly drifts.
None of that is a knowledge problem. It’s an ownership problem — which is exactly what Cybersecurity Awareness Month is meant to surface.
Turn Cybersecurity Awareness Month Into a 12-Month Habit
Pick the two items above that made you wince, and fix those this month. Then put a recurring reminder on the calendar to review the rest each quarter. If you’d rather someone else owned it, that’s what we do — eMDTec keeps small and mid-size businesses across New Jersey protected year-round, not one month a year.
Your Next Step
Not sure where to start? A short conversation is usually enough for us to tell you where your real risk sits.