Cybersecurity Awareness Month is an international initiative that focuses on simple ways to protect ourselves, our families, and our businesses from online threats. The 2025 theme “Secure Our World” highlights the pervasiveness of digital technologies that enable connections across the globe and how straightforward, yet effective, measures can have a lasting impact.   

In a world where our digital lives are increasingly intertwined, every attack vector secured increases the safety of other connected people. And considering how connected we all are to our devices, networks, and the internet at large, this can be a lot of us.  

Here are four easily accessible ways we can secure our digital world.  

Credentials Protection

As threat actors get savvier about targeting access credentials, the industry is gradually moving away from passwords altogether and into a Passwordless future.  

This means switching wholesale to other forms of authentication, which may leverage biometric data, PINs, patterns, and passkeys in place of passwords. With a growing number of platforms supporting Passkeys and Passwordless authentication, moving away from passwords is becoming easier and frictionless. 

If Passwordless options are not feasible, the recommendation is to use strong passwords with a password manager and use a distinct password for each account. Reused passwords give cybercriminals bonus access to other areas of a person’s digital life when they’ve only done the work to steal (or buy, or crack) a single credential.  

Current wisdom suggests that a strong password contains at least 16 characters, with a mix of letters, symbols, and numbers, or potentially a “passphrase” of 4-7 words.  

In either case – passwords or passwordless passkeys – a password manager is needed (here’s why). With the average person having to keep track of roughly 100 distinct credentials, it’s no wonder that nearly one-third of the internet uses a password manager to wrangle – and “remember” – them all. 

Recognising and Reporting Phishing

According to the Thales 2024 Data Threat Report, phishing is the second fastest-growing attack. Phishing tactics are getting sneakier thanks to AI, and it is more important than ever that employees be able to recognise their telltale signs.  

Now, AI-based campaigns can churn out word-perfect emails in any language, typically: 

• Creating a sense of urgency and panic, which short-circuits your critical-thinking brain
• Encouraging some unsolicited action, such as “change your password now” or “download now”
• Asking for some form of personal information, usually financial data 

However, the most effective way to enable people to spot and report phishing emails is to strengthen the “human firewall.”  Businesses should invest in security awareness training programs not only for their employees but also for their families to establish a positive culture where everyone is invited to report mistakes, such as clicking on a malevolent link. 

Multifactor Authentication

Multifactor Authentication (MFA) is a required layer of security by many cloud service providers and even more everyday organisations. CISA, ENISA, and other global security agencies advise that everyone adopts it, as it provides additional layers of defense on top of just passwords alone, such as a text verification code, or a fingerprint. 

There are various MFA options available: 

• Phishing-resistant MFA is known by CISA as the “gold standard” and encompasses FIDO/WebAuthn authentication and Public Key Infrastructure (PKI)-based methods.
• App-based MFA methods increase security by sending a pop-up or “push” notification to the user’s phone, generating a one-time password (OTP), or using a token-based OTP. 
• SMS or Voice MFA simply relies on sending the user a verification phone call or text. 

It is essential to note that while phishing-resistant MFA is most effective against AI-enabled social engineering attacks, any form of MFA is much better than no MFA at all. In addition, there’s great business value behind adopting MFA. The Thales 2024 Digital Trust Index indicates that 81% of customers expect brands to offer MFA, which serves as a means to greater loyalty and trust. 

Software Updates

It is crucial that all employees know to accept and apply software updates every time the reminders come up because these are how vulnerabilities stay patched. One Ponemon report noted that 60% of breaches originate from unpatched vulnerabilities, making this simple practice even more vital.  

Criminals have quickly embraced AI to spot and exploit even zero-day vulnerabilities. Interestingly, these unpatched gaps open the way for spreading disruptive ransomware attacks.  

However, businesses, especially in critical infrastructure settings, should patch their systems with caution and not out of fear. Although timely security updates are crucial, it is equally important to test those updates in a controlled environment before rolling them out to minimise the possibility of breaking critical systems. 

The overall goal of the Cybersecurity Awareness Month is to enhance the security posture of identities, applications, data and software —either personal or corporate data. Good defensive measures don’t have to be difficult to use or implement. In fact, keeping it simple and using practical, easy to use tools and procedures will generate even wider adoption.