Cybersecurity Awareness Month 2026

We checked both at the source on October 9, 2026.

United States. The National Cybersecurity Alliance has framed 2026 around Don't Make It Easy for Them, with four core habits: strong unique passwords kept in a password manager, multifactor authentication, recognizing and reporting scams, and keeping software updated. CISA's campaign page carries the same four behaviors and positions the agency as the federal lead.

Canada. The Communications Security Establishment announced Cyber Security Awareness Month 2026 under the theme "Your best defence is you", with a topic for each week: Recognize cyber threats, Strengthen your defences, Protect your information, and Build your cyber security community. The same release cites the 2026 Get Cyber Safe tracking survey: 59% of Canadians reported at least one cyber incident in the past year, 73% are concerned about AI-related cybercrime, and only 42% feel confident they can recognize AI-generated content.

That last gap is the useful one. Concern is high, confidence is low. Staff do not need more fear in October. They need one practiced move per week.

Three reasons, in order of how often we see them.

It measures attendance, not behavior. "92% completed the module" tells you who clicked Next. It does not tell you who reports a phish or who calls a vendor back. NIST's SP 800-50 Rev. 1, published September 2024, reframes awareness as a continuous learning program with planning, measurement and improvement, not an annual event.

It asks people to compensate for missing controls. The Verizon 2026 DBIR found vulnerability exploitation is now the top initial access vector at 31% of breaches, and third parties are involved in 48%. No poster patches a VPN appliance or vets a supplier.

It ends. Habits built in a month without repetition decay. Ask anyone who has rerun a phishing simulation in March after a strong October.

The stakes are not abstract. IBM's 2026 Cost of a Data Breach report puts the global average breach at $4.99 million, and 92% of organizations that had an AI-related breach lacked AI access controls. Awareness alone fixes neither number. Awareness paired with controls moves both.

Each week maps to one Canadian weekly topic and one US core habit, so a cross-border team hears a consistent message. Each week has exactly one behavior and one metric. Capture the baseline on day one of the week.

Behavior: every suspicious email, text or call gets reported through one channel (a report button in your mail client or a single Slack channel). Run one simulated phish on Monday and another on Friday.

Metric: report rate and time to first report. Click rate matters less than whether someone tells you within minutes. If you have no report button yet, that is the week's real deliverable. Our phishing guide covers what staff should look for.

Behavior: each person enrolls in MFA on every work system and moves work credentials into the company password manager. Prefer authenticator apps, passkeys or hardware keys. NIST's SP 800-63B treats SMS codes as a restricted authenticator, and says organizations should not force periodic password changes without evidence of compromise.

Metric: percentage of accounts with MFA enforced, from your identity provider, not a survey. Our target is 100% of email, identity, finance and code repositories by Friday.

Behavior: each person reviews files they have shared by "anyone with the link" and revokes what no longer needs it, then confirms which AI tools are approved for customer data. Unapproved AI use is where we now find most accidental exposure; see what shadow AI looks like.

Metric: number of public links revoked and number of unapproved AI tools identified. Expect the first number to surprise you.

Behavior: any request to pay, change bank details, reset MFA or share credentials gets verified by calling back a number you already have, never the one in the message. Run a 45 minute tabletop with finance, support and one executive using a fake vendor bank-change email.

Metric: percentage of payment and bank-detail changes in October with a documented callback. Make it a finance control, not a suggestion. Your incident response plan should name who staff call.

Our opinion, after running this with small teams. Vendors selling training libraries will disagree with the bottom rows.

Skip the four-week format if any of these apply.

What this program does not stop: an unpatched internet-facing system, a breached supplier, or a determined insider. Those need vulnerability management, vendor risk reviews and access controls, which is governance, risk and compliance work, not awareness work.

Treat October as quarter one of a twelve-month cadence. The order matters more than the content.

This also satisfies the regulators on both sides of the border. Canada's Baseline cyber security controls for small and medium organizations list employee awareness training as control BC.6.1. PIPEDA Principle 4.7.4 requires organizations to make employees aware of the importance of keeping personal information confidential. In the US, the FTC Safeguards Rule requires security awareness training for financial-sector firms, and the HIPAA Security Rule requires a training program for every workforce member. SOC 2 and ISO 27001 auditors both test for training evidence, so the monthly report rate becomes audit evidence instead of a scramble.

If nobody inside the company owns this cadence, that is usually the gap a fractional security lead fills. Our Virtual CISO service starts from $2,000 a month for 15 to 20 hours, and running the awareness calendar is one of the first things we take off a founder's plate; details are on our pricing page.

No. The weekly topics are not date-locked. Start the four weeks on whichever Monday you are ready and finish in November. The behaviors matter more than the calendar.

Fifteen to twenty minutes of live time plus the week's action. Longer sessions raise attendance numbers and lower retention. The tabletop in week four is the exception at 45 minutes.

Not to start. A report button, your identity provider's MFA report and a spreadsheet will carry a 50 person company through October. Our list of free cybersecurity tools covers options. Buy a platform when you need automated simulations and audit-ready reporting.

One named owner with authority to enforce MFA and the payment callback rule, usually the COO, CTO or a fractional CISO. If the owner cannot change a control, the program becomes posters. Book a call if you want help setting up the first quarter.