Cyber threats never stand still. AI is now helping attackers move faster, target more businesses and make their attempts more convincing. But the gaps they rely on are often the same: weak passwords, missed updates, unnecessary access and unsecured devices.
For Cyber Security Awareness Month, we're turning the focus back to the security basics that are easy to overlook.
Here are six areas worth checking across your organisation, now and throughout the year.
1. The account without enough protection
A password may be long and difficult to guess, but it can still be stolen through phishing or exposed in a data breach. If you use the same password across several accounts, one stolen password could put all of them at risk.
That's why multi-factor authentication (MFA) is so important. Even if someone has your password, they still need another form of verification to sign in.
Never approve an MFA request you weren't expecting. It could mean someone already has your password and is trying to access the account.
Quick check: Does every account that supports MFA have it enabled, and does every account have a unique password?
2. When software falls behind
Software updates do more than add new features. They also fix security weaknesses that attackers could use.
Keep the laptops, phones, browsers and applications your team uses up to date. If technology is no longer supported, it stops receiving security fixes and should be upgraded or replaced.
Quick check: Are updates being installed and is any unsupported technology still in use?
3. Who still has access?
When someone joins your organisation, they are given access to the files, systems and cloud services needed for their role. If they change roles or leave, their access needs to change too.
Otherwise, they may keep access to information or systems they no longer need. If their account is compromised, that gives an attacker more opportunities to reach your organisation's information.
Quick check: Does everyone's access still match their current role?
4. When an urgent request cannot wait
A junior member of your team receives an email that looks as though it has come from a senior colleague. It asks for a payment to be made that day, mentions a supplier your organisation works with, and fits with work already underway.
The pressure to act quickly is deliberate. Pausing gives you time to question the request and verify it through another route.
AI can make the deception more convincing by drawing on familiar names, natural language and information available online.
Security Awareness Training helps your team recognise these tactics, pause before acting and know how to respond.
Quick check: Would your team recognise the warning signs and feel confident questioning an urgent request?
5. Are your work devices properly managed?
Personal phones, tablets and laptops are often used to access work emails, files and cloud services. If these devices haven't been approved or properly secured, company information could be exposed.
Make sure every device used for work has the right security settings and can be locked or wiped remotely if it is lost or stolen.
Quick check: Do you know which devices are being used to access your company information?
Your Cyber Security Awareness Month checklist
Cyber attackers will continue to change their tactics, but the security basics still make a real difference. Reviewing these areas regularly can help you find gaps early and reduce the opportunities attackers have to get in.
How well are the basics covered across your organisation? Start with this checklist:
-
Use unique passwords and MFA across important accounts
-
Keep devices and applications updated
-
Identify and replace unsupported technology
-
Make sure access still reflects each person's current role
-
Encourage your team to question unusual or urgent requests
-
Check that work devices can be locked or wiped remotely
Build stronger security foundations with Cyber Essentials
Cyber Essentials is the UK Government's recommended minimum standard for cyber security.
It brings together five protective measures covering your internet connection, devices, software, user access and malware protection.
Working through the certification helps you find and address security gaps across your organisation.
It also shows customers and suppliers that important protections are in place and that you take cyber security seriously.
With a certified Cyber Advisor and a team of Cyber Essentials Assessors, we can help you understand the requirements and prepare for certification or renewal.
Ready to get started? Talk to our Cyber Essentials team.
Call us: 0131 603 7910
Message us: https://www.grantmcgregor.co.uk/contact-us
