Cyber Security Awareness Month: Your Best Defence Is You

October is Cyber Security Awareness Month in Canada, and this year’s theme from Get Cyber Safe is a short sentence with big consequences: “Your best defence is you.”

Not your firewall. Not your antivirus subscription. You, and the person two desks over who just clicked a delivery notice that looked almost right.

That theme lands at an uncomfortable moment. Last month we walked through where a business should actually start with adopting AI tools. Criminals read the same trends. Kaspersky’s 2026 threat report for small and mid-sized businesses found that in the first four months of 2026 alone, attackers launched 33,352 attacks disguised as popular AI tools. That is almost five times more than the same period in 2025.

The scams have changed. The defence hasn’t.

The 2026 threat data tells a clear story about where attacks on businesses like yours actually come from now:

One more number that should end the “we’re too small to bother” conversation for good: on dark web forums where criminals sell break-in access to company networks, posts offering access to small and mid-sized businesses account for more than half of all listings. Small companies are the supply chain for attacks on bigger companies. Your invoice portal or remote access box is worth real money to someone whose target is your largest client.

Three scams you should expect this month

Kaspersky’s researchers documented the actual mechanics. Here are the three most common plays, so you can spot them in your inbox:

• The fake document notification. An email that looks like it came from your file sharing service. The message is personalized with your own email address parsed into company and user name, and it includes reassuring language like “encrypted and hosted within your secure cloud perimeter.” The button leads to a credential harvesting page. Real file sharing notifications link you to log in through the app you already have open, not a fresh page asking for your password.
• The meeting that never existed. A calendar-style email invites you to a meeting. Accepting routes you through a legitimate-looking document site, and a second “accept invitation” click lands on the phishing page. Two-stage scams like this exist specifically to defeat the glance test.
• The compliance scare. A notice claiming a compliance issue with your online ads or listings, warning that something will be suspended. Urgency plus authority plus an unfamiliar process is the classic recipe. Any email that threatens suspension and asks for credentials deserves a phone call to the real vendor before a single click.

Notice what all three have in common: technical defenses had almost nothing to do with the outcome. The email arrived. The link worked. The page rendered. The single deciding factor was whether a person paused.

Your team is the control that actually moves risk

Get Cyber Safe’s campaign focuses on four weekly themes through October, including strengthening your defences with strong passwords, password managers, and multi-factor authentication, and wrapping up the month by building your cyber security community so good habits stick after October ends. Those habits map directly to controls that work:

• MFA everywhere it’s offered. A stolen password alone should never be enough to get into your email, your accounting system, or your file shares.
• A password manager for the whole team. Unique passwords per service, so one phished credential doesn’t open five doors.
• Download rules. Software comes from official sources, installed by the people responsible for IT. Anyone can “install a free AI tool” the way anyone can open the office safe.
• A pause protocol for money and credentials. Verify unusual requests by a second channel. A 30-second phone call has stopped more fraud than any filter we’ve deployed.

None of this requires a security expert on staff. It requires short, repeated practice and honest measurement. A good program runs brief sessions and simulated phishing campaigns through the year, tracked in the same ticket trail as the rest of your IT stack so nothing quietly falls through. The goal is not to catch your colleagues clicking. It is to build the reflex to pause, verify, and report, long before a real criminal tests it.

Make this Cyber Security Awareness Month the one that sticks

This is the fourth October running this blog has published during Cyber Security Awareness Month, and the first time we’ve written about the campaign itself. The reason is simple: every other post we’ve published covers a technology, and technology gets patched, replaced, and upgraded. The habits your team builds in October are the only control that shows up in every incident report, every year.

You do not need to become a security expert to be your own best defence, which is exactly the point Get Cyber Safe makes. You need to verify the odd message, keep MFA on, and talk to your team about what a scam looks like this month, because Kaspersky’s data says it looks like the tools your team is genuinely excited to use.