Cybersecurity Awareness Month 2026: 9 Things SMBs Should Know

Every October is Cybersecurity Awareness Month, and each year we round up some of the best cybersecurity practices for small and midsize businesses (SMBs). This year, we’re sharing nine things your business can do today to be more alert and proactive.

Software Updates: According to Verizon’s 2026 Breach Investigations Report, software vulnerabilities are the top way attackers get in, surpassing stolen passwords as the leading access point. The FTC suggests scheduling regular updates for programs, apps, web browsers, and operating systems, and turning on automatic updates.

Better Passwords: In place of predictable and/or repeated passwords, you may opt for longer (12+ character) passwords that don’t include personal details like your pet’s name, favorite baseball team, or wedding date. Password managers can help you generate and save more complex passwords. The FTC warns against sharing passwords over text, phone, or email.

Multifactor Authentication (MFA): MFA adds a second layer to your login process by sending your employee a code via text, email, or an authenticator app, for example, that they use to log in. Yes, it may take you an extra couple of minutes to log in, but it’s worth the effort. According to the U.S. CISA, the use of MFA on your accounts makes you 99% less likely to be hacked.

Phishing & Impersonation: Sadly, there are many types of phishing scams through which bad actors are trying to “hook” individuals on the job. This may look like an email asking you to reverify your login; someone calling you and acting like an authority figure trying to collect information; someone sending links via text message or redirecting you to a fake website to input login information or personal details; and more. 

This isn’t just happening on your computer; it’s happening on mobile. Verizon shares, “In phishing simulations, attacks with mobile-based entry points (e.g., voice and text) had a 40% higher median level of successful click rates than those entering via email.” 

Bad actors may also impersonate someone at work, such as your boss, coworker, or a vendor partner. From fake invoices that look real to fake HR departments requesting personal info, these points of contact deserve a second look before responding. Some ways to spot these bad actors include closely checking the sender's email or phone number and noticing whether the message is urgent or threatening. Bad actors also use AI to write better emails, so have your staff think carefully about the email content and the type of request. As always, verify with the person who supposedly sent the request.

Deepfakes and Artificial Intelligence (AI): These bad actors manipulate images, video, and audio to execute their trickery. For example, a bad actor may use AI voice-cloning to sound like your supervisor. Video, images, or audio that seem slightly off or unnatural, especially with urgent or unusual language, can be a cue. Again, always pick up the phone and verify with the person you know whether the correspondence is real. According to the FBI Internet Crime Report, in 2025, IC3 received more than 22,000 complaints reporting AI-related information. Adjusted losses of these complaints exceed $893 million.

AI Use by Employees: It is important to establish an AI policy for your team to ensure employees don’t input sensitive data, such as personal or financial information, into an AI tool the company has not approved. 

Review Cybersecurity Best Practices with Partners and Vendors: Breaches with third-party involvement are up 60% from last year, notes the Verizon report. Identify vendors that access sensitive information, such as your payroll or payment processing vendor, ask about their security measures, review their response plan, and clarify roles and responsibilities.

Virtual Private Networks (VPNs): A VPN establishes a secure “tunnel” between your device and the internet, which can add a layer of security.  If you have a remote workforce, travel for business, need to connect to an unfamiliar wireless network, or access sensitive information within databases or a shared drives, it’s especially helpful to turn on your VPN. It’s important to note that VPNs don’t block you from bad actors; rather, they can be used in conjunction with other cybersecurity best practices.

Review Your Cyber Insurance Coverage: These days, every business should secure a cyber insurance policy, in addition to practicing cybersecurity best practices. You do not need to own a tech company to need cyber insurance. If you are using a mobile device to call or text, or a computer, or if you’re working with third parties who are doing so, you should strongly consider a standalone policy. Our team here at FOA can answer questions about exclusions, deductibles, how to respond to an incident, and more. Get in Touch.

These are just a few of the many steps your business can take to strengthen its defense against cyberattacks. 

Disclaimer: This information is intended for reference only and should not be considered as financial or legal advice. Consult with a qualified professional for personalized guidance.

Sources:

Zywave, Cybersecurity Awareness Month 2026 Employee Education Packet

Verizon Business, 2026 Breach Investigations Report

Verizon, Cybersecurity Insights for SMBs (infographic)

Federal Trade Commission, Cyber Security for Small Businesses

CISA, Multifactor Authentication

FBI  Internet Crime Report, p. 39