Most Cybersecurity Awareness Month activity inside a small business consists of a phishing simulation, a poster, and an all-hands reminder about password hygiene. Then October ends and nothing structural has changed. This checklist is built the other way around: start from what the 2026 breach data says actually compromises companies your size, and use the month's budget attention to close those specific gaps.
Cybersecurity Awareness Month runs every October, co-led in the United States by CISA and the National Cybersecurity Alliance. 2026 marks the 23rd year of the campaign, which has operated under the "Secure Our World" umbrella since 2023; CISA and NCA publish the current year's toolkit and partner assets ahead of October each year, so check their resource hubs for this year's materials rather than reusing last year's deck. Awareness materials are the easy part — the checklist below is the part that changes your risk.
Start From the 2026 Numbers, Not the Poster
The Verizon Data Breach Investigations Report for 2026 makes the small-business picture unusually blunt. 96% of ransomware victims were SMBs, and ransomware was involved in 48% of all analyzed breaches, up from 44% the prior year. Human behavior contributed to 62% of breaches.
The mechanism data is where the planning value sits. 73% of ransomware victims experienced an infostealer or credential compromise first, and 50% had credentials stolen within 95 days before the ransomware event. Among small-business attacks, 38% of victims had compromised credentials. On initial access, phishing accounted for 16%, credential abuse for 13%, and pretexting for 6% — and phishing via text message and voice call achieved a 40% higher success rate in simulations than email did.
Read together, that describes a specific attack chain rather than a general threat: credentials get stolen, sit for weeks or months, then get used. Which means the highest-leverage October project for most SMBs is not more awareness training. It is making stolen credentials useless and detecting their use. Everything in Tier 1 below follows from that.
Tier 1: The Credential Chain (Do These First)
Audit MFA coverage — not whether you have it, where it isn't
Almost every SMB now says it has MFA. Very few can produce a list of the accounts and access paths that bypass it. Pull the actual coverage report and look for the standard gaps: service accounts, legacy authentication protocols still enabled on your mail platform, VPN or remote-access paths configured before MFA rollout, administrative accounts with break-glass exceptions that were never re-secured, and third-party integrations authenticating with a static credential. Given that 38% of small-business victims had compromised credentials, an MFA gap is the difference between a stolen password being noise and being an incident.
Check whether your MFA method survives phishing
SMS and push-approval MFA are meaningfully better than nothing and meaningfully worse than phishing-resistant methods. With voice and text phishing outperforming email by 40% in simulation, an attacker who can call your controller can often talk them through a push prompt. Moving administrative and finance-adjacent accounts to phishing-resistant authentication — passkeys or hardware security keys — is a scoped, achievable October project, and you do not have to do it for everyone at once. Start with the accounts whose compromise ends the company.
Get infostealer exposure visibility
This is the item most SMBs have never done and the one the 2026 data most directly supports. If 73% of ransomware victims had a prior credential compromise, then knowing whether your users' credentials are already circulating is early warning rather than trivia. Ask your provider whether they monitor for exposed corporate credentials in infostealer logs and breach corpora, what the alerting path is, and what the response playbook is when a hit appears. The 95-day median window between theft and use is your response time — but only if someone is looking.
Verify session and token handling
MFA at login does not help if a stolen session token grants indefinite access. Confirm session lifetimes on your mail and identity platforms, that token revocation actually happens on password reset and offboarding, and that conditional access rules trigger reauthentication on risk signals. Our identity and access management guide covers the underlying architecture.
Tier 2: Assume the Credential Chain Fails
Test a restore, not a backup
With ransomware in 48% of breaches, the restore path is your actual recovery plan, and "backups are running" is not evidence it works. Do a real restore of a real business system in October and measure how long it takes end to end. Then check the two things that break restores during ransomware specifically: whether backups are immutable in a way an attacker with domain admin cannot toggle off, and whether your backup infrastructure authenticates separately from production identity. We cover how to interrogate vendor claims on this in vetting ransomware-resistant backup claims.
Confirm someone is watching outside business hours
The gap between stolen credentials and ransomware deployment is where detection earns its cost. Ask directly: who receives an alert at 3 a.m. on a Sunday, what is their response commitment, and can they show you a recent example of an after-hours escalation? If the honest answer is that alerts queue until Monday, you have monitoring rather than detection and response. SIEM vs XDR vs MDR explains what the different service models actually commit to.
Write down who you call
Incident response retainer or not, the contact list should exist before you need it: your provider's escalation path, your cyber insurer's required notification number and timeline, outside counsel, and forensics. Insurers frequently require notification within a short window and may restrict which forensics firms are covered — finding that out during an incident is expensive. See incident response: who to call.
Tier 3: Make the Awareness Part Actually Work
Training is not useless — human behavior contributed to 62% of breaches. It is just usually aimed wrong. Two adjustments make October training worth the hour it costs.
Simulate voice and text, not just email. If those channels succeed 40% more often, an email-only program is testing the attack your staff is best defended against. A voice-pretext simulation aimed at finance and help-desk-adjacent roles will produce more actionable findings than another email campaign.
Train the verification procedure, not the vigilance. "Be suspicious of unusual requests" does not survive a convincing caller. A written procedure — payment or credential changes are verified through a second channel using a number from your own records, and no employee is ever penalized for pausing a transaction to verify — does. Pretexting was 6% of initial access, and the countermeasure is a process, not an attitude.
What to Skip
Two things reliably consume October and produce nothing. Forced password rotation without any other change moves users toward predictable variants and adds nothing against the credential-theft chain the data describes. And buying a tool because the month prompted it — a new platform with nobody assigned to tune, monitor, and respond to it is a line item, not a control. If the honest answer to "who watches this" is nobody, the money is better spent making existing MFA coverage complete.
The practical version of this checklist is short enough to start this week: pull your MFA coverage report and find the exceptions, ask your provider whether they monitor for exposed credentials and what happens when they find some, and schedule one real restore test for October. Those three actions map directly onto the chain that produced most 2026 SMB incidents. The posters can wait.
Frequently Asked Questions
When is Cybersecurity Awareness Month 2026?
October 2026, as every year. It is co-led in the US by CISA and the National Cybersecurity Alliance, and 2026 marks the campaign's 23rd year. Both organizations publish toolkits and partner materials ahead of October — use the current year's assets rather than recycling prior-year messaging.
What is the single highest-value security project for an SMB this October?
Closing MFA coverage gaps on the accounts and access paths that currently bypass it. With 38% of small-business victims showing compromised credentials and 73% of ransomware victims having a prior credential compromise, making stolen passwords unusable addresses the most common entry point in the 2026 data.
Is security awareness training worth it?
Yes, but aim it correctly. Human behavior contributed to 62% of breaches, so the training has a target — however, phishing via text and voice succeeded 40% more often than email in simulations, so an email-only program tests the weakest attack. Simulate voice and text pretexting, and train a written verification procedure rather than general vigilance.
How do we know if our credentials are already compromised?
Ask your IT provider whether they monitor infostealer logs and breach corpora for your corporate domains, how you get alerted, and what the response playbook is. Half of ransomware victims had credentials stolen within 95 days before the attack — that interval is only useful if someone is looking during it.
← Build vs. Buy: The SOC Decision in 2026 | Incident Response: Who to Call →