Back to Blog

We’ve Covered 29 Attacks This Year. Most of Them Came Down to the Same Four Gaps.

October is Cybersecurity Awareness Month. CISA and the National Cybersecurity Alliance run it every year, and this year the campaign theme is “Don’t Make It Easy for Them.”[1] That’s good advice. It’s also been the implicit theme of almost everything we’ve published since March.

We started writing this blog to give Pittsburgh-area small businesses something concrete to act on, not just a headline. And looking back at the past seven months of posts, a pattern is hard to ignore. The attacks change: a FortiMail zero-day one week, a fake Interpol ransomware campaign the next, North Korea using fake job offers the week after that. But the conditions that allowed those attacks to succeed? Almost always the same four things.

CISA publishes four recommended security actions every October.[2] They haven’t changed much in three years. They also haven’t become irrelevant. Here’s what they actually mean in context.

Multi-Factor Authentication

The September post covered four nation-state groups exploiting the same Windows vulnerability. Before any of that happened, in most of those intrusions, an account credential was compromised first. The post from August covered North Korea using fake recruiting emails to plant a rootkit that could blind endpoint security software. Same starting point: a credential, then a foothold, then the damage.

MFA is the layer that makes a stolen password useless on its own. The problem is that not all MFA is equal anymore. We covered this directly back in September: attackers are calling employees on their personal phones, pretending to be IT help desk, and stealing Microsoft 365 session tokens using an adversary-in-the-middle proxy. An SMS code gets intercepted in real time. That campaign has been running since May.

The answer is to stop using SMS codes for MFA on any business-critical account. Use an authenticator app. Use hardware security keys for admin-level accounts. It’s a bit more friction for your team, but it’s the friction that matters.

Strong, Unique Passwords (With a Password Manager)

In September, Verizon’s breach research found that 73% of ransomware incidents started with compromised credentials, and that half of those credential events happened more than 95 days before the ransom demand.[3] The attacker probably bought a credential dump from a breach that happened years ago on a completely different site. Your employee reused the same password.

A password manager fixes this. It generates random, unique passwords for every account, stores them encrypted, and fills them in when needed. The only password anyone on your team needs to remember is the one that unlocks the manager. Bitwarden is free. 1Password and Dashlane have business plans with centralized management. Pick one and actually get everyone using it.

Recognizing and Reporting Phishing

We’ve covered phishing delivered via email, SMS, phone call, and voice clone. The delivery method changes every few months. The goal is always the same: get one person to act without thinking.

Training on this doesn’t work as a single annual event. It has to be a reflex. When something arrives asking for urgent action, a password reset, a wire transfer, a click on a link, the instinct to pause and verify has to be there. Building that reflex means making it easy to report suspicious messages and never punishing someone for raising a false alarm. A culture where people feel dumb for flagging something is a culture where phishing succeeds.

Keeping Software Updated

VMware vCenter got patched on July 29. Ransomware was spreading through the same vulnerability five days later. That’s the window. It’s not weeks anymore.[4]

The gap for most small businesses isn’t the Windows updates that run automatically in the background. It’s the stuff that doesn’t nag you: the firewall, the VPN appliance, the email security box, the router the ISP installed years ago. Those devices sit on the edge of your network, internet-facing, and they don’t send you a “your software is out of date” pop-up. Someone has to be watching vendor security advisories and scheduling patching for that equipment. If nobody is, it’s just waiting.

The Thing CISA Doesn’t Say Out Loud

Security Magazine ran a piece this month arguing that CISA’s four recommendations aren’t enough for the attacks organizations actually face in 2026.[5] They’re not wrong, exactly. Session hijacking, SIM swapping, and AI-generated deepfake phishing aren’t fully addressed by the four-item list. But here’s the thing: most small businesses I talk to haven’t finished the four-item list yet. That’s the actual starting point.

Before you worry about passkeys and hardware tokens and zero-trust architecture, find out whether your team is reusing passwords, whether MFA is actually turned on for every account (not just some of them), whether anyone knows how to report a phishing attempt, and whether someone is patching your network gear on a regular schedule. Those four things, done well, remove the lowest-hanging fruit that attackers pick first.