October is Cybersecurity Awareness Month. This is the 23rd one, run since 2004 by the National Cybersecurity Alliance together with the Cybersecurity and Infrastructure Security Agency, and this year they have given it a theme worth borrowing: Don't Make It Easy for Them.
The campaign names four ways organizations make it easy. Password cracking. Unprotected accounts. Unpatched systems. Phishing scams. Against each one it pairs an action: use strong passwords and a password manager, turn on multifactor authentication, update your software, and recognize and report scams.
If you own or manage a business with 10 to 500 people, that list is a reasonable place to start. It is also, read a second time, a list of three very different things and one odd one out.
Three of those four get solved by a decision you make once. The fourth one does not, and the fourth one is the inbox.
The three that are configuration
Password cracking has a known answer. Long, unique passwords that nobody has to remember, held in a password manager. You pick a tool, you roll it out, you are substantially better off than you were, and the problem mostly stops being a daily problem.
Unprotected accounts have a known answer too. Turn on multifactor authentication everywhere it is offered, starting with email and anything that touches money. This takes an afternoon of annoyance and then it is on.
Unpatched systems have a known answer as well: updates get applied, on a schedule, by whoever runs your technology. Worth saying plainly that this one is not ours. We do not sell patch management. If you have an internal IT person or an outside IT provider, this is the month to ask them what the patch cadence actually is and when it last ran on everything, not just the laptops.
What these three share is that they are states. A setting is on or it is off. You can audit them in an afternoon. Once they are on, they stay on until somebody changes them.
The fourth one is a judgment call, made fresh, every time
"Recognize and report scams" is not a state. It is a decision somebody has to make, correctly, on a message they have never seen before, usually while doing something else.
Your controller gets a message at 4:40 on a Friday. It comes from a real domain. There is no attachment. There is no bad link. The sender knows the project name, knows who the vendor is, knows roughly what the last invoice looked like. The request fits the way your business already works, because somebody spent time learning how your business works.
Nothing about that message is technically wrong. That is the whole design.
This is why the fourth item behaves differently from the other three. You cannot switch it on. You can train people, and training helps, and we provide security awareness training and phishing simulation as part of what we run. But training raises the odds on a judgment call. It does not turn the judgment call into a setting.
What reduces it is somebody looking at what is actually arriving, every day, and acting on the ones that matter.
What the primary data says
Two sources worth reading rather than taking anyone's summary of, including ours.
The FBI Internet Crime Complaint Center 2025 annual report. For 2025 the IC3 recorded 1,008,597 complaints and $20.877 billion in reported losses across all crime types. Within that:
- Phishing and spoofing: 191,561 complaints. That is the number one complaint type by volume in the entire report, ahead of extortion at 89,129 and investment fraud at 72,984.
- Business email compromise: 24,768 complaints and $3,046,598,558 in adjusted losses. That is the second largest loss category in the report, behind only investment fraud at $8,648,617,756.
- Ransomware, for comparison: 3,611 complaints and $32,320,105 in reported losses.
Do the division on the business email compromise line and you get roughly $123,000 per reported complaint. That is the number worth sitting with, because business email compromise is the quiet one. There is no screen telling you that you have been locked out. An invoice gets paid to an account that is not your vendor's, and depending on how your reconciliation works you may find out in a week or in a quarter.
Two honest caveats on that table. The IC3 figures are only what people chose to report to the FBI, so every line is a floor rather than a total. And the IC3 says in its own appendix that the ransomware number "does not include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services acquired by an entity." So read that ransomware line as reported payments and direct losses, not as the cost of a ransomware event, which is usually far higher. The comparison that holds here is about email fraud volume and per-complaint loss. It is not a ranking of which kind of incident hurts a business more.
The Verizon 2026 Data Breach Investigations Report. This is cross-industry, global data rather than a view of businesses your size, so treat it as direction rather than as your own numbers. In this year's dataset Verizon reports:
- The human element was involved in 62% of breaches. That is Verizon's broad category, which covers mistakes and misuse as well as somebody being tricked, so it is not a phishing number on its own.
- Phishing at 16% of initial access, unchanged from the prior year.
- Exploitation of vulnerabilities at 31% of initial access, up from 20% last year and now the most prominent initial access vector in Verizon's data.
- Credential abuse at 13% of initial access, down from 22%, though Verizon notes credentials still turn up at some point in 39% of breaches. Worth knowing that this drop is partly a counting change: Verizon split pretexting out as its own vector this year, and reports that measured the way it measured last year, credential abuse would have come in at 16% rather than 13%.
Note what that says about the campaign's four threats. The three that are settings are not small problems. Patching in particular is the thing that moved most in Verizon's data this year, which is a good argument for having that conversation with whoever runs your technology this month.
And phishing sits at 16% and flat, inside a human element that touches 62% of breaches. It did not spike. It also did not go anywhere, after two decades of awareness campaigns, filters, and training. That is the point. The categories that are settings get fixed and stay fixed. The one that is a judgment call stays roughly where it is, year after year, because there is always a new person, a new vendor, a new Friday afternoon.
One more Verizon finding belongs here precisely because it works against the argument we are making. Verizon reports that 41% of social engineering breaches now involve vectors other than email, with roughly a quarter of social action vectors coming from social media or phones. Email is still the majority channel at around 59%, and Verizon reports phishing and email as the primary methods inside that pattern.
But the honest version is that locking down the inbox does not close the whole category. Somebody calling your front desk pretending to be your bank is the same play on a different wire, and no email product sees it. That is a reason to train people, not only to filter mail.
Where AI actually changed this, and where it did not
There is a lot of noise about AI phishing right now, so here is the part that is measured rather than asserted.
Verizon's 2026 report finds that phishing accounted for 44% of the AI-assisted initial access techniques it observed. At the same time it reports that phishing success rates in its incident data stayed stable year over year.
Read those two findings together and you get something more useful than the headline. AI has not made phishing dramatically more effective per attempt. What it has done is make the expensive part cheap. Writing fluent, specific, well-researched email in someone else's voice used to take a person with time. Now it takes a prompt.
So the realistic change is not that each message is magic. It is that there are more of them, they are better written, they contain fewer of the spelling and grammar tells your team was taught to look for, and they arrive from senders that look legitimate because the attacker took the trouble to look legitimate.
Which lands exactly on the odd one out. AI made the volume and polish of the one threat you cannot fix with a setting much cheaper to produce. The three configuration items are unaffected. A password manager does not care whether the attacker used AI. Multifactor authentication does not care. Updates do not care.
The inbox cares.
What "don't make it easy" means for an owner this month
Not a tips list. Four questions that have actual answers, and that you can ask this week.
1. Who looked at your email quarantine yesterday? If the answer is nobody, or the answer is a person who looks when they remember, then the filter is running and nothing is being managed. There is a difference, and we wrote about the signs that nobody is working the quarantine in more detail.
2. What happens when somebody reports a suspicious message? The campaign says recognize and report. Report to whom, and what do they do in the next ten minutes? If reporting means forwarding it to a colleague who also does not know, the reporting half of that instruction is not doing anything.
3. If an attacker had a valid session in one of your mailboxes right now, how would you find out? Account takeover is the version of this that skips the password entirely. Multifactor authentication is necessary and it is not the whole answer, because a stolen session does not prompt for it.
4. Which of your staff inboxes can authorize money moving? That is a short list in most businesses with 10 to 500 people. It is usually the owner, somebody in finance, and an office manager. Those are the inboxes worth protecting first, and they are the ones a researched request is aimed at.
Three of those four questions are about the inbox, which is not an accident. It is where the campaign's hardest item lives.
Where we fit
cAIberOps is a managed security service provider in McLean, Virginia. We run managed email security and managed endpoint protection for small and medium businesses, with security awareness training, phishing simulation, dark web monitoring for leaked credentials, and web threat protection available as part of the same managed service.
On the email side the work is the part that is not a setting: the daily review of what reached your inboxes and what sits in quarantine, acting on the account takeover signals, and running the training and simulation so your team sees a safe version before they see a real one. The controls we run support frameworks including HIPAA, the FTC Safeguards Rule, NIST 800-171 and CMMC readiness, SEC Regulation S-P and CJIS. They support those frameworks; they do not by themselves make an organization compliant with any of them, and we would be careful of anyone who tells you otherwise.
If you want to see what is actually arriving before you decide anything, there is a free two week email security assessment. It runs alongside your current email in monitor only mode. We quarantine nothing and change nothing, and you keep the written report either way.
We work with small and medium businesses nationwide from our home base in McLean, Virginia, and we are glad to come to you if you are in the Washington DC, Northern Virginia or Maryland area. If October is the month you look at this, book a free 15-minute call and we will tell you plainly whether what you have is doing the job.
Sources
- National Cybersecurity Alliance and CISA, Cybersecurity Awareness Month 2026, theme and recommended actions: staysafeonline.org
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report: ic3.gov
- Verizon, 2026 Data Breach Investigations Report: verizon.com/business
