.png)
Let’s be honest for a second …having technical security measures in place isn’t enough. It never was, and that isn’t about to change now. Not by a long stretch.
Sure, technical security measures might tick a box, keep your board happy (for a while), and they might even make a difference, temporarily. But that’s about it.
And here’s why this matters: every single year, millions of people deal with the fallout of cyberattacks. They cost organisations billions, and cause a whole lot of very real stress for real people.
If you’re reading this, you already get it. But knowing security matters and actually behaving securely during a busy workday are two very different things.
Why are we talking about this now? Because it’s Cybersecurity Awareness Month (CAM).
CAM has run every October since 2004. What started with the National Cybersecurity Alliance (NCA) 22 years ago has now grown into a massive global movement. And 2026 is shaping up to be the biggest yet.
This year’s theme (Don’t make it easy for them) is refreshingly realistic.
Security isn’t about making one heroic, stress-induced decision under pressure. It’s about building a few tiny, repeatable habits during normal, everyday moments. If enough people do small things consistently, an attacker’s job gets a whole lot harder.
The campaign focuses on four core daily habits:
Knowledge doesn't equal behaviour change. (If only.)
We all know we should eat more greens and sleep eight hours a night. But do we? …Some of us do, the rest of us try. But we know we should – that’s not the issue.
Lecture people? Doesn't work. Trick them with mean phishing tests? Backfires. Run campaigns that fight against basic human nature? Waste of budget.
CAM’s theme is human-friendly, because it’s all about simplicity, small steps, and routine. It works because it taps into basic psychology:
Fair question. But CAM isn't about routine compliance training. It is about momentum, community, and energy.
It’s about igniting excitement, and making people feel like they’re playing an active, important role in the solution.
Tackling human risk can feel like a slog, but you can’t afford to let campaign fatigue set in. Awareness month is your excuse to make security approachable, visible, and (dare we say it) fun.
Want a campaign that actually lands? Tap into these proven psychological triggers:
We’re all wired with shortcuts. The availability heuristic makes us overreact to dramatic news headlines, while the bandwagon effect makes us click a link if we think ‘everyone else got this email too’. Call these biases out directly in your messaging so people catch themselves in the moment.
Not everyone in your business speaks fluent IT. Tailor your message to different teams and knowledge levels. Don't worry about making it perfect …even basic segmentation delivers way higher engagement than a massive blast email.
Give people space to share tips, talk through mistakes, and celebrate good habits. When security becomes a team topic rather than an IT rulebook, culture shifts.
Long-term risks (i.e. ‘our stock price might dip in 3 years’) feel abstract. Highlight short-term, personal consequences instead …like the hassle of locked accounts, lost work time, or personal data leaks.
Interactive quizzes, departmental escape rooms, and leaderboards turn boring topics into friendly competition.
Nobody likes being micromanaged. Empower your team to take personal pride in their digital safety, and watch your incident reporting rates climb.
Memory fades fast. Use October to kick off year-round nudges, quick blog posts, and lightweight updates that keep security top-of-mind.
Ready to plan? Grab our updated Security Awareness Engagement Toolkit for 2026 to build a campaign that drives real behaviour change.
So, in this blog, we tackle the burning questions many cyber pros ask themselves as October 2026 approaches:
Cybersecurity Awareness Month is your chance to make a difference. And this guide is about to make it easy. Impactful. Fun. Memorable.
There are tons of reasons why cybersecurity awareness is important. Here are some of the biggest ones:
You and your team may have overall responsibility for protecting your organisation.
But you can’t do it alone.
That’s why it’s important for everyone to be aware of cybersecurity risks and to take steps to protect themselves…and their organisation.
Our Oh, Behave! report, run with the National Cybersecurity Alliance, surveyed 5,000 people.
An overwhelming 80% of adults now use AI tools daily, and half of all workers use them on the job …mostly on their own initiative. But corporate guardrails haven't caught up: 52% of employees using AI have received zero security training on it.
The result? Workplace Shadow AI is running rampant. One-third of workers admit to copy-pasting confidential company data into public AI bots without their boss ever knowing.
On a personal level, users are routinely confessing their deep secrets, health records, passwords, and even banking details to chatbots. We’re worried about AI cybercrime, sure – 67% of us fear AI-driven scams – but that hasn't stopped us from treating the chatbot like a digital therapist and administrative assistant all rolled into one.
Which is why running a 2026 security campaign without addressing AI is like running a campaign in 2010 and ignoring the internet. (I.e, not clever).
And remember: people don't need another dense 10-page AI policy document. They need three basic habits:
Every year during Cybersecurity Awareness Month, amazing work is done by the community to support, guide and educate people, to highlight new threats, to reinforce best practice, and to strengthen relationships within organisations.
But…
One of the biggest differences between Human Risk Management and Security Awareness & Training, is planning the impact of your activities-beyond ticking the compliance box-before you start.
Taking the time to understand this before you start your Cybersecurity Awareness Month planning will make it much easier to demonstrate the value of your activities when you’re done.
Need inspiration? Mix and match these 50 ideas to build your custom month-long itinerary:
At the end of the day, you can pick and choose. This is just a starting point. You know what will work best for your team, and you’re more than capable of choosing activities that will fit your needs and engage your people.
---
At CybSafe, we take pride in our science-based, expert-led approach to cybersecurity. It’s been proven to be highly effective in helping organisations reduce their risk of cyberattacks.
And, frankly, this is too good not to share, so we’re dropping the link here.
Exclusive to the toolkit, access to eight story-style blogs:
If you're building a business case for your campaign budget, don't rely on generic statistics. Ground your strategy in data from our latest studies:
---
There have been many inventive CAM campaigns over the years, but here are a few of our favourites…
The University of California, Berkeley created a Cybersecurity Scavenger Hunt that challenged students to find hidden security vulnerabilities on campus. We love how they used gamification to make it fun and engaging for students to learn about cybersecurity risks. This taps into the psychology of motivation, as people are more likely to learn and retain information when they’re having fun.
The City of San Francisco created a cybersecurity comic book that told the story of a group of hackers who try to steal the city’s data. This was a creative way to reach out to a younger audience and teach them about cybersecurity risks. This uses narrative persuasion, which is a powerful way to communicate information because it appeals to our emotions and helps us to understand complex concepts.
The National Cybersecurity Alliance created a cybersecurity selfie challenge that encouraged people to take selfies with cybersecurity messages. This was a fun and social way to raise awareness of cybersecurity risks. This uses social proof, which is the tendency for people to follow the lead of others. When we see that other people are taking selfies with cybersecurity messages, we’re more likely to do the same.
The University of Texas at Austin created a cybersecurity escape room that challenged students to solve puzzles and find clues in order to escape from a locked room. This was a fun and interactive way to teach students about cybersecurity risks. This uses experiential learning, which is a type of learning that occurs when we actively participate in an activity. This type of learning is often more effective than traditional forms of learning, such as reading or listening to lectures.
The Seattle Public Library created a cybersecurity trivia night that challenged people to answer questions about cybersecurity. This was a fun and social way to raise awareness of cybersecurity risks. This uses gamification, which is the use of game-like elements in non-game contexts. Gamification can be a great way to make learning more fun and engaging.
Capital One created a cybersecurity training arcade that allowed employees to learn about cybersecurity risks in a fun and interactive way. This was a great way to engage employees and teach them about phishing, malware, and other cybersecurity threats. This uses operant conditioning, which is a type of learning that occurs when we’re rewarded for our behaviour. When employees are rewarded for learning about cybersecurity, they’re more likely to continue learning and practising safe behaviours.
Visa created a cybersecurity theatre that put on a series of plays about cybersecurity risks. This was a creative way to reach out to a wider audience and teach them about cybersecurity risks. Like the comic book, this used narrative persuasion to great effect.
The ‘This is Personal’ campaign by the UK government is a powerful campaign that highlights the human cost of cyberattacks. This campaign features real-life stories of people who have been affected by cyberattacks. It’s been praised for its emotional impact. This uses emotional appeals, which are a powerful way to persuade people.
These are just a few of the many inventive CAM campaigns that have tickled our fancy. They demonstrate the power of creativity and innovation in raising awareness of cybersecurity risks.
If you sidestep these hurdles and sprinkle some behavioural science, creativity, and innovation into your cybersecurity awareness campaigns, you’ll be well on your way to success.
We also asked our panel of pros to explain what has worked well for them in past years. Here’s what they hit us with:
Junell Felsburg, Sr. Director of Cyber Security and Infrastructure, The Columbus Foundation
“While it is easy to assume everyone shares the same foundational understanding of cybersecurity, the truth is each individual brings their unique perspective and experiences to the table. As cybersecurity professionals, we must recognize this diversity as the strength it is, and tailor our messaging accordingly.
Using storytelling, we can transform complex concepts like threat and risk management into captivating tales that resonate with our audience. For instance, we might liken the challenges of defending against cyber threats to the heroic struggles of knights protecting an ancient castle, or use a narrative of cunning assassins to illustrate the dangers of phishing attacks.
But storytelling isn’t just about entertainment—it’s about engagement and empowerment. By sparking curiosity and fostering a deeper understanding of cybersecurity issues, we can encourage our communities to ask questions, seek further knowledge, and take proactive steps to enhance their digital safety.”
Stu Walton, Deputy Director of Digital & IT Services, Newman University
“While we’d love all our staff to have the intrinsic motivation to behave safely and engage in activities over Cyber Awareness Month, we know sometimes they need a little recognition for the additional engagement they give throughout the month.
When it came to running my first Cyber Awareness Month, I gave out certificates to participants for the events we had on. All staff who had engaged with us over the month got a signed certificate, hand-delivered.
Admittedly, we are a single-site campus where nowhere is more than five minutes’ walk, but it was amazingly effective. Walking into shared offices with a sheaf of certificates and handing them to staff was great for me and them, because I got to see the joy on their faces for recognizing their contribution. Not to mention their colleagues who didn’t get one asking why, and I could then point them to additional resources or any activities we had coming up.
The personal touch was really in keeping with our organizational culture and made a big impression. So much of our work and communication is digital; I think people really liked having something tangible to show for it. I’ve since discovered that they love pin badges, too!”
James Mountford, Security Awareness & Culture Lead, AVEVA
“Running an inclusive and engaging security awareness month encourages autonomy and ownership within our workforce. We had a variety of activities for colleagues to participate in.
By offering a range of options and training opportunities, employees are empowered to take ownership of their own security journey. Participation in these initiatives not only equips employees with the necessary knowledge and resources, but also instils a culture where reporting suspicious activities is encouraged and celebrated. This multifaceted approach helps colleagues feel in control of their own security, which makes them more likely to report suspicious activity and create a safer digital and physical space.”
Nick Allen, Information Security Specialist, Just Eat Takeaway
“After using SebDB to target our key behaviors, we were able to implement nudges as a form of light reinforcement for colleagues, and saw an enormous change in behavior as a result.”
Louise Cockburn, Information Security Awareness and Culture Manager
"Last year as part of our CAM events, we put together a series of videos and a panel talk from some of our security operations team. They talked about their experiences with common security attacks, like account takeovers and social engineering, and the habits they formed to combat these threats. Kind of a, “I work in Security and this is one thing I ALWAYS/NEVER do!”
Stories and storytelling are really effective ways to impart messages – especially around topics that can feel dull, technical, scary, or abstract. We found that hearing what our team of very technical and skilled security pros have witnessed or even experienced themselves was really impactful, creating a lot of engagement and discussion in both the video comments and during the panel talk (the themes of which were great qualitative metrics for us to note!).
Not only that, but it helped ‘humanise’ security as a function – which can often be perceived as a bit intimidating and unapproachable.
From a social proof point of view, if someone who works full time in security has been sufficiently moved to make a habit change and says a certain habit or behaviour is a MUST, it lands with clout, and harnesses that persuasive “appeal-to-ethos” effect (we’ve seen a similar effect with talks and webinars we hosted featuring subject matter experts from a variety of fields).
As an event, this was a very simple case of having some of the team do a very informal video which we then edited and published internally over the course of the month. The panel we hosted through Teams, and used the corporate calendar, email, and comms channels to publicise.
Metrics & measurements of success:
Running cybersecurity awareness month in the UK
Cybersecurity Awareness Month may be a global campaign, but it works best when it feels relevant to the people taking part. For UK organisations, this means using situations employees genuinely recognise from their working lives.
Think about the kinds of threats people encounter every day: a convincing Microsoft 365 login request, a fake supplier invoice, an urgent Teams message that appears to come from the managing director, or a parcel delivery text sent to a personal phone. When examples feel real, people are more likely to remember what to do when a genuine threat appears.
It’s worth thinking about timing, too. October is often a busy month, and the autumn half-term can interrupt your campaign just as it gets going. Promote activities early, spread them across the month and give people different ways to join in, whether they work in an office, from home or on the move.
The UK practitioners featured in this guide, including Stu Walton at Newman University and James Mountford at AVEVA, show that effective awareness programmes don’t need to rely on fear. Personal recognition, relatable stories and simple opportunities to participate can do far more to change behaviour than another warning about regulatory fines.
Above all, Cybersecurity Awareness Month shouldn’t feel like four weeks of warnings and compulsory training. CybSafe recommends using it to start useful conversations, build practical security habits and give people positive reasons to take part. Relatable stories, well-timed nudges and a little personal recognition can help cybersecurity feel like part of everyday working life, not another box to tick.
Let’s say it again (for the people at the back): You have the power to make a real difference here. By being smart about your CAM game, you can upgrade your organisation’s security posture and inspire people to take steps to protect themselves and your organisation.
We believe that people are the key to iron-clad cybersecurity. Which is why our solutions are engaging, educational, and effective. (And frankly, if you haven’t booked a demo yet, what are you waiting for?)
Chances are your brain is bursting with ideas by now, and you’re in planning mode. We’d love to know how your CAM went down and what you got up to, so feel free to tag us in your socials so we can live vicariously through you.
Here’s to securing our world, and making #CAM2026 count.
---
When is Cybersecurity Awareness Month?
Cybersecurity Awareness Month is observed every year in the month of October. It is a month-long initiative filled with activities, events, and educational efforts to promote cybersecurity awareness.
When did Cybersecurity Awareness Month start?
National Cybersecurity Awareness Month, often referred to as CAM, began in 2004. It was initiated by the National Cyber Security Alliance (NCSA) in the United States. Since then, it has grown into a global event, with millions of organisations participating to promote cybersecurity awareness and education.
What is Cybersecurity Awareness Month?
Cybersecurity Awareness Month (CAM) is an annual global campaign dedicated to raising awareness about the importance of cybersecurity. It aims to educate individuals and organisations about cybersecurity risks, best practices, and how to protect themselves from cyber threats.
What is CISA Cybersecurity Awareness Month?
CISA (Cybersecurity and Infrastructure Security Agency) Cybersecurity Awareness Month is an initiative by the U.S. federal government, specifically led by CISA. It is a part of the broader Cybersecurity Awareness Month and focuses on promoting cybersecurity best practices, resources, and information within the United States.
What is a Cybersecurity Awareness Month toolkit?
A Cybersecurity Awareness Month toolkit is a collection of resources, materials, and guides that individuals and organisations can use to support their cybersecurity awareness campaigns during October. These toolkits typically include posters, templates, social media content, and educational materials to help promote cybersecurity awareness effectively. For example, you can find valuable resources like the Security awareness engagement toolkit.
What are the themes for Cybersecurity Awareness Month in 2026?
Cybersecurity Awareness Month features different themes each year to focus on specific aspects of cybersecurity. The 2026 theme is ‘Don’t make it easy for them’, and it focuses on the everyday habits that make an attacker’s job harder.
Each habit maps to a measurable behaviour in SebDB, CybSafe's open database of security behaviours. Use these to plan what you measure, and to show what changed.
These themes reflect the commitment to building a more secure, interconnected world.
Building a security-conscious workforce isn't about ticking compliance boxes. It's about helping your people build small, everyday habits that keep them (and your organisation) safe.
Download the 2026 Security Awareness Engagement Toolkit to get started.
.avif)
.png)
