Cyber Security Awareness Month, minus the posters

October 1, 2026

"Think before you click." It will appear on a lot of LinkedIn banners this month, usually next to a padlock and a stock photo of someone in a hoodie. October is Cyber Security Awareness Month in Canada, and the advice that circulates is well meant. It is also, for the most part, the wrong advice for a business of twelve people.

The reason is simple. A slogan asks people to be careful forever, without exception, on their busiest day. That simply will not hold. Verizon's 2024 Data Breach Investigations Report found that roughly two thirds of breaches involved a person: someone clicking, someone being fooled, someone making an ordinary mistake. Telling people to stop making mistakes does not change that number. Building systems that survive the mistake does.

So rather than another poster, here are the three changes we would make first in almost any small office, and what each one actually takes.

1. Make a stolen password worthless

Most compromises start with a valid password. It was reused from a breached website, typed into a convincing fake login page, or guessed. Once an attacker has it, they simply sign in, and to the system they look exactly like your employee.

Multi-factor authentication breaks that chain. With it enforced, a password on its own no longer gets anyone in. The word that matters there is enforced. In the small businesses we look at, multi-factor is usually switched on for most people and missing for one or two accounts: an owner who found it annoying, a shared mailbox, an old account nobody remembers creating. One exception is all it takes.

What it takes: an afternoon in Microsoft 365 or Google Workspace, plus a few minutes per person to set up an authenticator app. It is also the first question on almost every cyber insurance application.

2. Make a bad day recoverable

While prevention gets most of the attention, recovery is what decides how expensive an incident becomes. Ransomware that encrypts your files is a disaster if your only copy is the encrypted one. It is an irritating afternoon if a clean copy sits somewhere the attacker could not reach.

Unfortunately, many small businesses believe they already have this covered because their files live in Microsoft 365 or Google Workspace. Those platforms keep the service running. They are not built to bring back a folder deleted three months ago, or files that synced up already encrypted. We went through the gaps in detail in Microsoft 365 is not a backup.

What it takes: a third-party backup that stores copies outside your main environment, and one test restore to prove it works. The test is the part people skip, and it is the only part that tells you the rest is real.

3. Make money harder to redirect

The most expensive small-business losses are often not break-ins at all. They are payments sent to the wrong account because an email asked for it. A supplier's mailbox gets compromised, a request arrives to update banking details, and the next payment goes to the attacker. No malware is involved, which is precisely why so many defences miss it.

What it takes: one written rule. Any change to payment details gets confirmed by phone, on a number you already had, before any money moves. It costs nothing, and it is the control that stops this fraud cold. We covered how it plays out, and why construction gets hit first, last month.

What about training?

Training has a place. With that being said, it works best on top of the three changes above, not instead of them. Fifteen minutes with the team looking at real examples of this season's phishing does more than any annual video. However, a business that trains its staff without enforcing multi-factor has asked people to be the last line of defence, and people are a poor last line of defence on a Friday afternoon.

Our verdict

We don't doubt that awareness campaigns do some good. They put the topic in front of people who would otherwise never think about it. However, awareness is not a control. A small business that ends October having enforced multi-factor everywhere, tested one restore, and written down one payment rule is meaningfully safer than one that shared every poster and changed nothing.

Those three changes fit inside a single week. If you are not sure where you stand on any of them, our insurance-readiness review checks all three in thirty minutes, and you keep the written summary either way.