October is Cyber Security Action Month, Australia’s yearly push to turn cyber security awareness into action. This year’s theme is “Take a second. Stay secure.”, and for a business it comes down to one habit: pause before you click, share or respond. This guide turns that into seven small steps your team can take this month, in plain English and without the jargon.
In this guide
What is Cyber Security Action Month?
Cyber Security Action Month runs from 1 to 31 October 2026. It is an Australian Government campaign, and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) provides much of the practical advice. Many people still call it Cyber Security Awareness Month, but the emphasis now is on action: picking one simple step and actually doing it.
The theme, Take a second. Stay secure., asks you to pause before you click, share or respond to something unexpected. That one second is often all it takes to stop a scam email, a fake invoice or a dodgy link.
Why it matters for your business
Smaller businesses are not too small to be targeted. ASD’s latest published Annual Cyber Threat Report, for the 2024-25 financial year, shows what is happening:
cybercrime reports in 2024-25, about one every 6 minutes
average self-reported cost per cybercrime report for a small business, up 14% on the year before
of business cybercrime reports were email compromise with no loss (19%), or business email compromise fraud with a financial loss (15%)
Source: ASD, Annual Cyber Threat Report 2024-25 (published October 2025). Figures are self-reported averages and vary a lot between businesses.
The pattern is clear: email and sign-ins are where most business cybercrime starts. ASD also urges organisations to work with an “assume compromise” mind-set. That means planning on the basis that someone could get in one day, and making sure the business can recover when they do.
Seven small steps to take this month
You do not need to do all seven this week. Pick one, finish it, then pick the next. That is exactly what the campaign is asking for.
1. Turn on multi-factor authentication, then move toward passkeys
Multi-factor authentication (MFA) means a stolen password alone is not enough to get in. Switch it on for email, Microsoft 365, your accounting software and any remote access. One date worth knowing: Microsoft is retiring its own SMS and voice code sign-in method in Entra ID on 1 February 2027. Anyone who only uses text-message codes will need a stronger method, such as the Microsoft Authenticator app or a passkey.
How we help: our Identity Protection and Conditional Access services set up sign-in rules that block risky logins and phase out weak methods.
2. Update everything, starting with what faces the internet
Criminals look for known weaknesses in software that has not been updated. Turn on automatic updates for computers, phones and apps. Patch routers, firewalls and remote access tools first, because they are the doors that can be seen from the internet.
How we help: our managed IT services keep patching on schedule so it never slips.
3. Use passphrases and a password manager
A passphrase is four or more random words. It is long enough to be strong and easy enough to remember. Use a different one for every account, and let a password manager do the remembering. Never reuse your email password anywhere else.
How we help: our Microsoft Secure Score reviews show which sign-in and password settings in your Microsoft 365 are the weakest.
4. Check your email protection
Email compromise was the most reported cybercrime type for businesses, so email is the best place to spend an hour. Check that SPF, DKIM and DMARC are set up so criminals cannot easily send emails that pretend to be your business. Also check that safe links and safe attachments are switched on in Microsoft 365.
How we help: see our Email Security service.
5. Back up, and test a restore
A backup you have never restored is just a hope. Make sure your important files and systems are backed up somewhere ransomware cannot reach, then restore a test file this month to prove it works.
How we help: our Cloud Backup and Recovery service backs up and tests restores for you.
6. Make payment changes hard to fake
Business email compromise often starts with a convincing message from a “supplier” with new bank details, or from a “boss” asking for an urgent payment. Set a simple rule: any change of bank details, or any unusual payment request, is confirmed by phone on a number you already have, never one supplied in the email. Have a second person approve the change.
7. Train your team to take a second
Your people are your best defence and your biggest target. Short, regular training on spotting phishing, fake invoices and scam texts works better than one long session a year. Scam season is also close: Black Friday is on 27 November and Cyber Monday is on 30 November, when fake delivery notices and too-good-to-be-true deals do the rounds.
How we help: our Security Awareness Training gives your team short, practical lessons built around real scams. We also map your setup to the ASD Essential Eight.
A 10-minute check you can do today
- ☐ Does everyone use MFA for email and Microsoft 365, and does anyone still rely only on text-message codes?
- ☐ Are automatic updates on for computers, phones, routers and firewalls?
- ☐ Does your team use a password manager and unique passphrases?
- ☐ Is DMARC set up for your email domain?
- ☐ When did you last restore a file from backup?
- ☐ Who must approve a change of bank details, and how do they confirm it?
If you answered “not sure” to any of these, that is your starting point for this month.
If something goes wrong
Act quickly and stay calm. Disconnect the affected device from the network, change the passwords for any accounts involved from a clean device, and tell your bank straight away if money may have moved. Then report it. You can report cybercrime through ReportCyber on cyber.gov.au, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
How we help: if you need help containing and recovering from an incident, our Cyber Incident Response team can step in.
Questions we get asked
When is Cyber Security Action Month?
It is held every October. In 2026 it runs from 1 to 31 October.
Is MFA enough on its own?
No. MFA is an important step, but it works best with updates, backups, email protection and trained staff. Where you can, choose stronger methods such as authenticator apps, passkeys or security keys over text-message codes.
Where do I report a scam or cybercrime?
Report cybercrime through ReportCyber on cyber.gov.au, and report scams to the ACCC’s Scamwatch. For urgent help, call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
Related reading
- SPF, DKIM and DMARC for Microsoft 365 Email Security
- Passkeys in Microsoft 365: Passwordless Sign-In Explained
- How to Set Up MFA for Microsoft 365: 7 Steps
- Microsoft 365 and the ACSC Essential Eight Explained
- Backup and Disaster Recovery Testing for Microsoft 365
Sources: National Office of Cyber Security, campaigns and events; ASD, Annual Cyber Threat Report 2024-25; cyber.gov.au. Featured image: Photo: Yuri Samoilov, CC BY 2.0 (cropped), via Wikimedia Commons.
