4 Basics That Make Life Harder for Attackers
During Cybersecurity Awareness Month 2026, organizations should check four security basics: strong passwords and password managers, multifactor authentication (MFA), scam awareness, and software updates. They’re the core behaviors behind the National Cybersecurity Alliance’s 2026 theme, “Don’t Make It Easy for Them.”
So while IT teams already know the value of these controls, this month is a good time to revisit some of the basics and make sure they’re consistent across your environments. They keep showing up in security guidance for a reason: many breaches still begin with the same familiar weak points, including exposed vulnerabilities, compromised credentials, and phishing.
When IT teams support a wide mix of users, devices and systems, even familiar controls can become uneven over time. Cybersecurity Awareness Month gives IT teams a reason to look across the environment and see where those gaps have developed.
Here are a few things to look for as you review each of these four areas.
Most data breaches start in one of three ways: an exploited software vulnerability, stolen credentials, or phishing. These four areas keep showing up in security guidance because they still line up closely with how many attacks begin. Vulnerability exploitation accounted for 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), while credential abuse and phishing remained common entry points. The good news: Microsoft research found that multifactor authentication reduced the risk of account compromise by more than 99%.
Those numbers carry extra weight in environments where IT teams are managing large user populations, a mix of newer and older systems, specialized technology, and infrastructure that cannot always be updated or replaced on the same schedule. In those settings, even well-established controls can become inconsistent over time. Reviewing the basics gives teams a chance to catch those gaps before they become part of a larger security problem.
Make strong passwords easier by moving employees onto an approved password manager and updating password policies to favor length over complexity. Password security gets harder to manage when users are responsible for creating and remembering credentials across dozens of accounts. That process often leads to reuse, weak variations of the same password, or workarounds that are difficult for IT to control. With recent stats showing 41% of people still say they never use a password manager, there is plenty of room for improvement.
Start by identifying where employees still manage passwords on their own. Check for shared credentials, accounts outside an approved password manager, outdated password requirements, and privileged accounts that need tighter controls.
It is also worth reviewing the policies behind those passwords. Current guidance favors longer passwords over complicated composition rules, supports password managers and autofill, and no longer recommends routine password changes unless a credential has been compromised.
If you find gaps:
If the review turns up inconsistencies, start by finding where password practices fall outside the standard you want to enforce. Look for shared credentials, unmanaged password storage, and accounts that are still relying on outdated requirements. From there, decide which gaps can be fixed through policy and which need a better tool or workflow.
A good next step is to prioritize the accounts where a credential problem would create the most exposure. Privileged accounts, shared administrative access, and systems containing sensitive information are usually the best place to start. Once you clean those up, you can apply the same standards more broadly across the organization.
Require MFA on email, admin accounts, remote access, and cloud applications first, then extend it to every system that holds sensitive data. MFA is widely used, but coverage can still be uneven. Awareness of MFA reached 77% in 2025, while regular use remained much lower, meaning some accounts still rely on passwords alone.
Start by reviewing where MFA is required today and where exceptions still exist. Email, privileged accounts, remote access, cloud applications, and systems containing sensitive data should all be high on the list. Look for places where MFA is optional, inconsistently enforced, or tied to easier-to-bypass authentication methods.
It is also worth reviewing the type of MFA in use. For higher-risk accounts and systems, phishing-resistant MFA can provide stronger protection against social engineering and credential theft than methods that rely on one-time codes or push approvals.
If you find gaps:
Start by identifying which uncovered accounts or applications would create the most risk if compromised. Privileged accounts, remote access, and systems containing sensitive information should usually come first.
Then, look at why MFA is missing or inconsistently enforced. In some cases, the issue may be an application that does not support the authentication method you want to use. In others, exceptions may have accumulated over time, or older access workflows may never have been brought under the same policy.
Once you know where the gaps are and why they exist, you can prioritize remediation by risk and start moving higher-value accounts to stronger authentication methods.
Phishing awareness training should teach employees how to recognize scams in every channel, from email and text messages to phone calls and AI deepfakes, and how to verify and report anything suspicious. Social engineering has moved well beyond the traditional phishing email. Voice- and text-based social engineering simulations now generate 40% higher click rates than email phishing simulations, while fake invoices, impersonation, unexpected payment requests, and AI-generated voice or video give attackers more ways to make a request look legitimate.
Start by reviewing whether your awareness training reflects the types of scams employees are likely to encounter today. Training should cover more than suspicious links and attachments and give employees clear guidance on when to verify an unusual request, especially when money, credentials, or sensitive information are involved.
The reporting process is just as important. Employees should know exactly where to send a suspicious message or flag a questionable request, and the process should be easy enough that they use it when they are unsure.
If you find gaps:
Update training scenarios to reflect the channels and tactics employees are actually seeing, then make sure the reporting process is simple and well understood. If people are unsure how to verify or escalate a suspicious request, that is the first place to tighten the process.
Patch management should prioritize internet-facing systems, known exploited vulnerabilities, and technology that’s at or past end of support. Vulnerability exploitation accounted for 31% of breaches in Verizon’s 2026 DBIR, making it the leading initial access vector for the first time. That makes patching less about routine maintenance and more about how quickly you can identify exposed systems and act on the highest-risk vulnerabilities.
Start with visibility. Review whether your asset and software inventories are current enough to show what is running, where it is running, and which systems are falling behind on updates. Then, assess how you prioritize known exploited vulnerabilities, handle emergency patching, and track technology nearing or already past the end of support.
Older and unsupported systems deserve particular attention because vendors may no longer provide fixes for newly discovered vulnerabilities. If those systems are still in use, you should know where they are, what compensating controls are in place, and what the replacement plan looks like.
If you find gaps:
Start by separating routine patching issues from higher-risk exposure. Prioritize internet-facing systems, known exploited vulnerabilities, and unsupported technology first, then address the process gaps that allowed them to remain exposed. If asset visibility is incomplete, fix that before relying on patch metrics to tell you how well the program is working.
A security assessment is a good place to start: it reviews all four basics across your organization and shows which issues to fix first. Cybersecurity Awareness Month is a useful reminder to revisit controls that may already be in place, but not always as consistently as teams assume.
A review can surface gaps that are easy to miss in day-to-day operations: users still managing passwords outside approved tools, accounts without MFA, training that hasn't kept pace with newer scam tactics, or systems that have fallen behind on patches and support.
Finding those issues early gives IT teams a chance to tighten controls before they become part of a larger incident.
VLCM’s security team can help assess your environment, identify areas that need attention, and strengthen the controls behind these four security basics. Contact us to schedule a security assessment or consultation.