Cybersecurity Awareness Month 2026: A 10-Step Checklist for Orange County Businesses
October is Cybersecurity Awareness Month — a good reason to stop and check the basics before attackers do. The numbers from the past year make the case: cybercrime losses reported to the FBI rose 26% in 2025, and more breaches than ever started with a supplier or an unpatched system rather than a careless click. Here’s what changed, this year’s official themes and a 10-step checklist your business can finish before November.
Cybersecurity Awareness Month 2026 themes
This year, CISA’s campaign is “Securing the Next 250” and the National Cybersecurity Alliance’s is “Don’t Make It Easy for Them.” Both come back to the same four habits for every employee — long, unique passwords in a password manager, multi-factor authentication on every important account, reporting phishing, and installing updates promptly — and CISA adds three actions for organizations, its “3Rs”:
- Reduce
Shrink the attack surface
Apply patches promptly and keep every system and application current.
Patching · vulnerability scans - Replace
Retire what’s out of support
Upgrade or replace end-of-support software and devices before support ends — they stop getting security fixes.
Lifecycle planning - Recover
Practice getting back up
Keep a tested plan that sustains operations and restores them quickly after an incident.
Backups · incident response
The 2026 threat picture, in numbers
| Finding | What it means for your business |
|---|---|
| $20.877 billion in cyber-enabled crime losses reported to the FBI in 2025, up 26% | Attacks are growing in cost every year, and most victims are ordinary businesses, not headline names. |
| $3.046 billion lost to business email compromise in 2025 | Fake invoices and changed bank details are still the most expensive scam aimed at companies. A phone call to verify payment changes stops most of it. |
| 3,611 ransomware complaints to the FBI in 2025, up from 3,156 | Ransomware is still rising — and only a fraction of incidents are ever reported. |
| 48% of breaches involved a third party, up from 30% | Your vendors’ security is now your security. Ask suppliers and software providers how they protect your data. |
| Exploited software vulnerabilities overtook stolen credentials as the top way in | Unpatched firewalls, VPNs and servers are being found and hit faster than ever. |
| 73% of ransomware victims had stolen credentials or an infostealer infection first | Ransomware usually starts weeks earlier with a stolen login — which is why MFA and monitoring matter. |
| Text and phone phishing succeeded 40% more often than email in simulations | Training has to cover texts and calls, not just email. |
| 45% of employees use AI tools at work; 67% of them through personal accounts | Company data is going into tools you don’t control. You need an AI policy and approved tools. |
Sources: FBI Internet Crime Complaint Center 2025 report and the 2026 Verizon Data Breach Investigations Report, as summarized by McDonald Hopkins and the Cyber Readiness Institute.
Your 10-step Cybersecurity Awareness Month checklist
- Turn on multi-factor authentication everywhere. Email, Microsoft 365 or Google Workspace, banking, payroll, remote access and every admin account. Prefer authenticator apps or passkeys over text messages.
- Move everyone to a password manager. Long, unique passwords for every account, shared securely when a team needs access — no spreadsheets, no sticky notes.
- Patch the edge first. Firewalls, VPNs and anything reachable from the internet get updates the week they’re released. Then servers, then workstations and applications.
- Retire end-of-support systems. Any computer still running Windows 10, old servers or unsupported firewalls should be on a replacement plan with a date.
- Put endpoint detection and response on every device, watched 24×7 by people — not just antivirus that waits for someone to read an alert on Monday.
- Lock down payments. Require a phone call to a known number before changing any bank details or sending a wire, and protect email with advanced filtering and impersonation detection.
- Train for texts and calls, not just email. Run phishing simulations, teach people how to report a suspicious message, and celebrate the reports.
- Test a restore. Keep backups of servers and Microsoft 365 or Google Workspace with at least one copy offline or immutable — and actually restore a file and a server to prove it works.
- Review your vendors and AI tools. List the suppliers and apps that hold your data, check how they secure it, and publish an AI acceptable-use policy with approved tools.
- Write down who does what in an incident. Who to call, how to reach your insurer, who talks to customers — then walk through it once as a tabletop exercise.
Don’t do it alone
Most small and mid-sized businesses can’t staff a security team around the clock — and attackers know it. CAL IT Group’s managed cybersecurity covers every step above as part of Managed Care: SentinelOne managed XDR watched by a 24×7 SOC, continuous vulnerability management, email security, security awareness training and phishing simulations, MFA and device management, and tested backup and disaster recovery.
We hold ourselves to the same standard: CAL IT Group is SOC 2 Type II attested across all five Trust Services Criteria, so the team protecting your business has had its own controls independently audited. See our multi-vector approach to defending people, devices, network and cloud.
Get a free cybersecurity risk assessment Talk to our security team
Looking for last year’s guide? Read Cybersecurity Month 2025: Protecting Orange County Businesses. Heading into the holidays? See what to lock down before the year-end break.