October is Cybersecurity Awareness Month. Offices put up a poster, send a presentation, and perhaps run a quiz.

Nice. But what happens on November 2?

If an employee gets a message that looks as though it came from the CEO, asking for an urgent money transfer, who do they call to check? And if they already clicked, do they know they can report it without being scolded?

Awareness is not a memory test. It is the moment someone stops, checks and raises a hand.

Before another training session, I would check three simple things:

Do employees have a short, clear way to report suspicious messages?
Are email and administrator accounts protected by phishing-resistant MFA?
Does someone actually handle reports and respond, or do they disappear into an inbox?

This year CISA stresses basic steps such as recognizing and reporting phishing, strong passwords, MFA and software updates. These are not topics for one month. They are year-round habits.

A good awareness month does not end with a nice poster.
It leaves a way of working that holds up on an ordinary day.

More about our work: https://artofcyber.co.il/

#InformationSecurity #CybersecurityAwareness #Phishing #CISO

Originally published in Hebrew on LinkedIn: view the original post