Your best defence is you: three cyber habits for a small firm or business

October is Cyber Security Awareness Month in Canada. The theme for #CyberMonth2026 is Your best defence is you.

It is a fitting theme for a small office. You probably do not have a security team. You do have a few habits, and those decide most of what happens. Here is what the campaign asks for, and what each habit looks like in a small firm or business this week.

Why the theme is about you

Get Cyber Safe puts it plainly: "In a world powered by artificial intelligence (AI), cyber threats can look more real than ever." Phishing emails and AI-made scams are harder to tell from the real thing.

The same page makes the hopeful point: "Many cyber incidents can be prevented with everyday actions. These include checking suspicious messages, turning on multi-factor authentication and using strong passwords".

Those three habits are the whole piece. None of them needs a budget.

1. Check suspicious messages

The first week of the campaign is about recognizing threats, and the advice is to learn why it helps to pause and check before you click, reply or share information.

In a small office, the messages worth a second look usually ask for one of two things: money, or a login. A client "with new banking details". A supplier invoice that suddenly pays to a different account. A sign-in page that arrived by email.

The step: agree, out loud and in writing, that any request to change where money goes is confirmed by phone on a number you already had, never the one in the message.

2. Turn on multi-factor authentication

The second week's advice: "Strong passwords, password managers and multi-factor authentication (MFA) are powerful tools for protecting your accounts".

The step: start with your email. The password resets for your other accounts usually arrive there. Then do the accounts that hold client or customer information, and your bank.

If you use Juris, you can turn on two-factor sign-in with an authenticator app under Settings, Security. It is optional, and only you can switch it on for your own account.

3. Use strong passwords, and let a manager keep them

The same week covers passwords and password managers. The reason a manager helps is simple: a different strong password for every account is hard to keep track of, and a manager keeps track for you.

The step: install one, then change the password on your email first, and on anything that reuses it.

Then pass it on

The last week of the campaign is about community: "Share what you have learned, talk to loved ones about online threats, and report scams and fraud". In a small office that can be five minutes at the next team meeting.

About the campaign

Get Cyber Safe runs Cyber Security Awareness Month in Canada. The campaign is led by the Communications Security Establishment Canada (CSE), with advice and guidance from its Canadian Centre for Cyber Security (Cyber Centre), on behalf of the Government of Canada. Its full Cyber Month page, with resources for each week, is here: Get Cyber Safe, Cyber Security Awareness Month.

#CyberMonth2026

Sources

• Get Cyber Safe, Cyber Security Awareness Month