Cybersecurity Awareness Month: 31 days of practical tech tips
FyrTech's 2026 calendar has one short, plain tip for each day of October, written to help small business owners and office managers stay secure.
October 2026
Keep this month's tips working all year
Security and compliance aren't a one-time event. The access review, backup check, and vendor check from these tips only protect you if they happen again on schedule. A security program is the list of those repeatable checks, the calendar they run on, the record that they ran, and the person responsible for all of it.
Ask yourself whether you have a security program, with repeatable checks on a schedule, or just a set of one-time fixes. If you need someone to assess where you stand, build a program, or run it, FyrTech can help.
All 31 tips
Every tip from the calendar in one list. Open any tip to read it.
Oct 1 · AIAgree on a code word for money requests
AI can now copy a person's voice, and even their face on a video call, from a short clip of them. A familiar voice or face on a call is no longer proof of who is really there. A shared code word lets your team confirm a caller is who they claim to be before any money moves.
Why it mattersThe FBI warned in 2026 that scammers "generate videos for real time video chats with alleged company executives," and that a real call can be hard to tell from "AI-generated voice cloning, as they can sound nearly identical."
Source: FBI Internet Crime Complaint Center, "FBI Warns of Scammers Impersonating the IC3," Alert I-072026-PSA, July 20, 2026. ic3.gov
Oct 2 · SecurityGo passwordless with passkeys
Multi-factor sign-in is still a must, but attackers now get around codes and push prompts with fake login pages that pass your code along in real time, or they spam you with prompts until you approve one. A passkey only works on the real website, so a fake login page can't use it to get into your account. There's no password to steal and no code to hand over.
Do this todayStart with your Microsoft or Google account, or the email account your other services depend on. Password resets go to that inbox, so whoever controls it can get into almost everything else. Turn on a passkey there first. You can do it yourself on a personal account. On a work account, your IT provider may need to switch passkeys on. Anywhere passkeys aren't offered yet, use an authenticator app instead of text-message codes.
Oct 3 · IT & TechnologyKeep one backup ransomware can't reach
Ransomware spreads to every backup it can find and locks or deletes those too, because that's how attackers pressure you into paying. So at least one copy of your important data needs to live somewhere an intruder already inside your network can't reach, whether that's offline, off-site, or locked against changes for a set time. And once you have that copy, remember that when systems go down, the slowest part is usually deciding what to bring back first.
Do this todayConfirm at least one backup copy sits somewhere an attacker inside your network couldn't reach, offline or locked against changes, not just on the same systems as everything else. While you're at it, jot down the two or three systems you'd need back first to keep taking orders and getting paid.
Related articleYour backups won't save you if attackers get to them firstOct 4 · Compliance & GovernanceSign users out everywhere when you disable an account
Turning off an account doesn't always sign the person out. A laptop or phone that's already signed in can keep working for a while afterward. When someone leaves, especially on bad terms, access has to end at the moment they're told.
How this goes wrongA company lets an employee go and believes the account has been shut off. The person is still signed in, though, and before anyone notices, they email the whole company and its outside partners saying they were wrongly fired.
Fix: Have HR and IT agree on the timing ahead of time. While the conversation is happening, IT disables the account and signs the person out of every session and device.
Related articleThe employee offboarding IT checklistOct 5 · SecurityEncrypt every laptop and phone
Laptops and phones get lost and stolen all the time. If the device is encrypted, you've lost the hardware. If it isn't, whoever has it may be able to get into your files, your email and any passwords saved on it. Encryption is built into every modern laptop and phone, and it's a basic best practice that many compliance rules expect.
Do this todayConfirm BitLocker or device encryption is turned on for every Windows laptop and FileVault for every Mac. Make sure every phone and tablet that touches work email or files has a passcode, since that's what makes their encryption protect the data. And if a device ever goes missing, treat it like a stolen credit card. Call your IT provider right away so they can lock or wipe it and sign it out of everything.
Oct 6 · IT & TechnologyGive each person only the access their job needs
Your payroll system probably has its own login, but the report someone exported from it last spring might be sitting in a shared folder that everyone can open. The same goes for HR records, client files and the owner's folders. If the front desk only needs the front-desk files, that's all their login should open. When each person can reach only what their job needs, private information stays private, and one mistake doesn't become everyone's problem.
Do this todayPick one employee and look at what they can open: shared folders, other people's inboxes, finance and HR files, admin settings. If it's more than their job needs, group access by role, like owner, finance and staff, and give new hires their role's access instead of everyone's. Keep admin rights to the one or two people who truly need them.
Oct 7 · SecurityLet laptops and phones update themselves
Keeping your computers and phones updated is basic maintenance, and one of the easiest ways to stay secure. They download updates on their own, but most updates don't finish until the device restarts. Your web browser works the same way. A computer that hasn't been restarted in months is probably missing fixes it already downloaded.
Do this todayCheck that automatic updates are on for every laptop and phone. When a device or browser asks to restart, do it the same day. If nothing has asked in a week, restart anyway, and make it a habit. If you run your own servers, those updates need more planning, so ask your IT provider.
Oct 8 · Compliance & GovernanceUse your cyber insurance application as a checkup
Your cyber insurance application is more useful than it looks. Insurers know from the claims they've paid what makes a business risky, so their questions show you the bare minimum you should be doing.
Ask your IT providerBefore we renew our cyber insurance, which of our answers aren't a full yes, and can you explain in business terms why each one matters?
Oct 9 · IT & TechnologyFind out how long it would take to get back up and running
Restoring one file from a backup takes minutes. Bringing back a whole office can take days, and every day you're down is a day you may not be able to take orders, send invoices or answer clients. Before you talk to your IT provider, decide how many days the business could afford to be down.
Ask your IT providerIf our main systems went down tomorrow, how long would it take to get us working again, and what would it take to get that number down?
Related articleHow to survive and prevent an IT emergencyOct 10 · AIGive your team an AI acceptable use policy
If your business has no position on AI, your employees are left guessing what's expected of them. A short policy settles that, starting with which AI tools are approved and what information never goes into them. Writing it also opens the conversation you need to have anyway, about how people use AI today and what part it should play in your business.
Do this todayAsk a few people on your team which AI tools they use and what they do with them. Their answers are where your policy starts.
Oct 11 · SecurityKeep admin access off your everyday account
Everyone makes mistakes, including the people with admin rights. When the account you use for email and browsing can also change settings for the whole company, one wrong click can reach everything. A separate admin account, used only when you need it, keeps an everyday mistake from becoming a business-wide problem.
Do this todayAsk your IT provider who has admin rights to your email and computers, and whether they use a separate account for admin work. If they don't, have a separate admin account set up for each person who has admin rights.
Oct 12 · Compliance & GovernanceFind out which rules already apply to your business
Most small businesses already have compliance obligations, whether they realize it or not. Every state has a data breach notification law, and your client contracts, your payment processor and your industry's regulators can each add requirements of their own. What they ask for is often the same thing, security practices you should have anyway, like limiting who has access and encrypting sensitive data.
Do this todayWrite down the outside requirements your business has to meet. Start with the regulations for your industry, then read your client contracts and your payment processor's terms for security requirements. Next to each item, note whether you know how you're meeting it.
Oct 13 · IT & TechnologyFind the systems that no longer get updates
Most businesses have a computer or program that's worked for years without anyone thinking about it, and that's why it's risky to assume it always will. Once its maker stops releasing updates, every security flaw found from then on stays open, and if it breaks or you need to change something, there may be nothing left to install.
Do this todayList the computers and software your business can't run without, and find out whether each one still gets security updates. For anything that doesn't, decide when you'll replace it, and until then ask your IT provider to isolate it from the rest of your network.
Related article"It Has Always Worked" Isn't a Support PlanOct 14 · SecurityKnow who you're dealing with
A professional website and a reasonable request are easy to fake. Before you start work for a new client or pay a bill from a company you don't recognize, take a few minutes to confirm the business is real. If what they say about themselves doesn't match what you find, believe what you find.
Do this todayLook the business up in its state's business registry, check when its website address was registered at lookup.icann.org, and search LinkedIn for the people who supposedly work there. A company that claims ten years in business but whose website address was registered last year doesn't add up.
Oct 15 · AITurn off the AI features you don't use
Apple, Google, Microsoft and others keep adding AI to the tools you already use, and a lot of it arrives switched on. Some of those features can read your email and documents or use what you write to train their AI. If you turn off the ones you aren't using, you decide what AI gets to see, and you can switch any of them back on once you understand what it does.
Do this todayOpen the settings on your phone, your email and your office software, and turn off any AI feature you aren't using. If you manage your company's Google or Microsoft account, you can switch some of these off for everyone.
Oct 16 · SecurityBlock sign-in methods you don't use
Your email and business accounts usually accept more ways to sign in than your team uses. Some are older methods left on for compatibility, and some are built for TVs and shared screens. Attackers look for the ones nobody's watching, because some of them can get around protections like multifactor authentication.
Do this todayAsk whoever manages your Microsoft 365 or Google Workspace account which sign-in methods are turned on, and block any that nobody uses. Keep exceptions only for the few people or devices that truly need them.
Oct 17 · IT & TechnologyChange the default settings on your router
Routers and other network equipment come with settings picked to make setup easy, and many owners leave them as they are. Default admin passwords are often printed on the device or easy to find online, and some older management features will answer requests from anywhere on the internet. Attackers keep scanning online for this kind of equipment, and a router's settings file can hold passwords they can copy.
Do this todayAsk your IT provider to check every router and Wi-Fi access point for a default admin password or remote management that's open to the internet, and to switch off any older management features nobody uses. While they're at it, have them install the latest firmware.
Oct 18 · SecurityKeep your work email for work
Signing up for personal sites with a work email address ties your business to every breach those sites suffer. When one of them gets hacked, attackers end up with a real work address, often with a password they'll try on your work login. The leak also shows where that person works and which site they signed up with, and attackers use that to write convincing phishing emails or threats.
Do this todayPut it in writing that work email is for work only. Ask everyone to move their personal accounts to a personal email address, starting with any site they wouldn't want tied to the business.
Oct 19 · Compliance & GovernanceKnow your vendors
Many businesses rely on more vendors than they realize, and each one has something of yours. They might be able to sign in to your systems, receive information you send them, or host your data on their own servers. Those connections are how a problem at a vendor becomes a problem for your business.
Do this todayIf you don't have a third-party risk program yet, start by listing your vendors and noting for each one whether it can access your systems, receives information from you, or hosts your data. Then go to the ones that hold the most sensitive information first, and ask them how they protect it and who you'd hear from if something went wrong. Review the list at least once a year.
Oct 20 · AIConfirm who you're hiring
AI makes it easier to swap a person's face and change their voice during a live video interview. Someone can get hired under a stolen name that way, then sign in to your systems like any other employee. The FBI says no single warning sign will catch them, so check identity at more than one step of hiring.
How this goes wrongA small online retailer hires a remote web developer after two video interviews that went well. The face on those calls is an AI swap, and the work laptop the owner ships goes to a stranger paid to keep it plugged in while the real worker controls it from overseas. By the time anyone notices, the new hire has been reading the store's customer records for months.
Fix: Meet your top candidate in person if you can. If you can't, hold a live video interview with the camera on and compare their face to the photo ID they send you. Ship the work laptop only to an address you've confirmed, and double-check if they ask to change that address or their pay account right after they're hired.
Oct 21 · SecurityGive the whole team a password manager
Passwordless sign-in is the best option, but plenty of websites and services still don't support it. Where you still need passwords, reusing one everywhere is risky because attackers take passwords leaked in one breach and try them on other sites. A password manager creates and remembers a different strong password for every account, so nobody has to.
Do this todaySet up a business password manager for everyone, starting with the logins for email and banking. Put shared logins in a shared vault so nobody sends a password by email or text again.
Oct 22 · IT & TechnologyLock down the account that controls your domain
Your email and website both depend on your domain name, and that domain is managed from one account at a company called a registrar. Anyone who can sign in to that account can point your email and website somewhere else or move the domain away. Domains usually get left to IT, so it's easy to forget this is one of the most important accounts your business has.
Ask your IT providerWho can sign in to the account that controls our domain, and is it protected with MFA and set to renew automatically?
Oct 23 · Compliance & GovernanceHave a plan before an incident happens
An incident response plan lays out how your company responds and the role each person plays. It spells out who leads, who makes the decisions, and who contacts the insurer. Cybersecurity regulations and best practices call for one, and cyber insurance applications ask whether you have it. Settling those roles ahead of time means your team isn't guessing or making decisions in the heat of the moment.
Do this todayWrite one page with the names of the person in charge and their backup. Put your cyber insurer's claims number at the top, since that's the first call once you know there's been an incident, along with your policy number and how many days the policy gives you to report it. Add the numbers for your IT provider, your lawyer, and your bank, then print it and keep a copy at home. At the bottom, write that nobody deletes or wipes files, accounts, or computers that could hold evidence, because the insurer will likely bring in a forensics firm to investigate.
Oct 24 · AIDon't let a hidden instruction run your AI assistant
If an AI assistant reads your email for you, every message it reads can try to give it orders. An email can carry instructions written for the assistant instead of you, and the assistant may follow them. In May 2026, six national cyber agencies, including CISA and the NSA, warned that a phishing email could use this trick to get an assistant to download malware. The less the assistant can reach, and the more often it has to ask you first, the less a hidden instruction can do.
Do this todayList the AI assistants that can read your email or act in your accounts. Give each one only the access its job needs, and don't give the same assistant access to both your email and your bank account. If it has a setting that makes it ask before it sends or pays, make sure it's on, and read each request before you approve it.
Oct 25 · SecurityMake it safe to say "I clicked something"
When someone clicks a bad link, a fast report gives your IT provider time to limit the damage. CISA, the US cybersecurity agency, advises making it easy and safe to report, even after someone has downloaded malware or shared data by mistake, because a no-blame culture leads to quicker action and less damage. What you tell your team ahead of time affects how fast they speak up.
Do this todayTell your team, in your own words, that anyone who clicks something that feels off should report it to you or your IT provider right away, even if they already typed in a password, and that nobody gets in trouble for it. Post where to send the report, such as one email address or a team chat channel. Then keep that promise, and the next time someone reports a click, thank them where the rest of the team can see it.
Oct 26 · IT & TechnologyList the devices nobody thinks of as computers
Cameras, printers, TVs, and smart thermostats sit on the same network as your computers but rarely get the same attention. Many of them still have their factory password, and many keep running after the maker stops sending security updates. A device that can be reached from the internet can be found and attacked by anyone.
Do this todayWalk the office and list everything that's connected to your network, by cable or wireless, but isn't a computer or phone, like security cameras and the box that records them, printers, TVs, and thermostats. Next to each one, write down who has its login and whether anyone ever changed its factory password. Then give the list to your IT provider and ask them to change any factory passwords still in place and tell you which devices can be reached from the internet.
Oct 27 · Compliance & GovernanceMake sure your security policy matches what you practice
Your written security policy gets read by more people than you think. Your cyber insurer asks about it when you apply, larger clients may ask for it before they sign, and in Ohio and Texas it can limit what you owe after a breach lawsuit. Each of them expects it to describe what you do. A policy that calls for reviews nobody does shows what you meant to do and didn't.
Do this todayPull out your written security policy and your most recent cyber insurance application. Walk through both with your IT provider and mark anything that doesn't match how you work today. For each mismatch, decide whether to change the document or the practice.
Oct 28 · AIKnow which AI note-takers join your meetings
An AI note-taker connected to one employee's calendar can join and record every video meeting on it. Most states let you record a conversation you're part of, but California and Massachusetts, among others, require everyone on the call to agree. When people on a call are in different states, the stricter rule can apply.
Do this todayAsk everyone to check the apps connected to their Google, Microsoft, or Zoom accounts for AI note-takers, and see which meetings each one joins. Then make it a rule that the host announces the note-taker at the start of every call and asks everyone before it records. If anyone says no, turn it off for that call, even if your own state allows recording.
Oct 29 · SecurityCheck that your domain blocks spoofed email
Anyone can type your company's email address into the From line of a message. DMARC is a setting on your domain that tells other email systems what to do with spoofed messages that use your exact domain and fail authentication checks. If it's set to "none," it only watches, while "quarantine" and "reject" ask the receiving system to send a spoofed message to spam or turn it away.
Ask your IT providerIs our DMARC policy set to quarantine or reject, or to none? If it's none, when can we move to a stricter setting?
Oct 30 · IT & TechnologyDecide which browser extensions your team can install
A browser extension is an add-on that gives Chrome or Edge extra features. Depending on the permissions you grant it, it can read and change the pages you visit, including webmail and banking. When anyone can install one in a few clicks, you end up trusting the makers of whatever extensions your staff come across, and nobody has checked them. Both browsers let an IT provider block every install except the ones on an approved list.
Do this todayAsk your IT provider to set Chrome and Edge so only approved extensions can be installed. Ask them to give your team a way to request a new one, and start the approved list with what people already rely on.
Oct 31 · Compliance & GovernanceKeep this month's tips working all year
Security and compliance aren't a one-time event. The access review, backup check, and vendor check from these tips only protect you if they happen again on schedule. A security program is the list of those repeatable checks, the calendar they run on, the record that they ran, and the person responsible for all of it.
Do this todayAsk yourself whether you have a security program, with repeatable checks on a schedule, or just a set of one-time fixes. If you need someone to assess where you stand, build a program, or run it, FyrTech can help.
Related articleTechnology Confidence Assessment
Want a clear read on where your technology stands?
The Technology Confidence Assessment is an independent review with no sales pressure. Browse the tips first, reach out whenever you are ready.