Cybersecurity Awareness Month Starts Thursday — The 5 Things I'd Fix First in a Valdosta Office

Turn on two-step login (MFA) for every email account

Email is the master key. Whoever controls your inbox can reset the password on your bank, your QuickBooks, your Microsoft 365, and your vendor accounts, and can send a "please update our payment details" note to your customers from your real address. The FBI calls that business email compromise, and in 2025 it drew 24,768 complaints and $3.05 billion in losses — the second-biggest loss category in the country, behind only investment fraud.

The fix is the second step: a code from an app on your phone, or a tap to approve, every time someone signs in from a new device. In a 2023 study of Azure Active Directory (now Entra ID) customer accounts, Microsoft's own researchers found that turning on MFA cut the risk of compromise by 99.22% — and by 98.56% even in cases where the password had already leaked. Two things I'd add from that same study and from CISA's small-business guidance: use an authenticator app rather than text-message codes (texts were about 40% less effective than the app in Microsoft's data, and CISA ranks them the weakest option), and start with the owner's account and anyone who handles money or payroll. If you've never set one up, my two-factor how-to walks through it.

Have one backup you have personally restored a file from

Not "we have backups." One backup that you, or I, have pulled a real file out of and opened. The #StopRansomware Guide from CISA, the FBI, the NSA and MS-ISAC is blunt about why: many ransomware strains go looking for any backup they can reach and delete or encrypt it first, so the guidance is to keep an offline, encrypted copy and to regularly test that you can restore from it. A drive that stays plugged into the server, or a cloud sync folder that mirrors your deletions in real time, is not that copy.

If you think this is a big-company problem, the FBI's 2025 report breaks down ransomware complaints from businesses outside critical infrastructure: legal offices were 18% of them, contractors and electricians 17%, engineering and architecture firms 10%. That's a South Georgia office park. And it isn't only businesses: Greene County, over east of Atlanta near Lake Oconee, was hit on July 9 this year, took its servers offline, and restored from its backups — then in mid-August posted a notice saying it had learned the attackers copied county data that may include employee Social Security and driver's license numbers. The backup got them running again. It didn't get the data back from the thieves, which is why item 1 comes first.

For a home or a one-person shop, my Windows backup how-to is enough to start. For an office, this is the item I'd rather do with you than describe, because "tested" is the whole point.

Get the updates flowing — and deal with the Windows 10 machines

The same #StopRansomware Guide's prevention section says to patch software and operating systems regularly and to prioritize anything that faces the internet, especially known exploited vulnerabilities. In a small office the practical version is simpler. Make sure Windows Update isn't stuck or switched off on any machine, make sure the browser and the remote-access tools update themselves, and make sure somebody actually notices when one doesn't. (Updates can also break things — Microsoft's September 8 patch caused enough trouble that it shipped a fix on September 14 — which is an argument for watching them, not for skipping them.)

Then the awkward one. Windows 10 stopped getting regular security updates on October 14, 2025. If you have a Windows 10 PC at the front desk, here's where that stands as of this week:

The full timeline is in my post on the Windows 10-to-11 support cutoff.

Put in a password manager, then let the rules get easier

Here's the part most people haven't heard. The federal password rules changed in July 2025. NIST's SP 800-63B Revision 4 now says a password used on its own must be at least 15 characters, systems must not force a mix of capitals, numbers and symbols, must not make you change passwords on a schedule (only when there's evidence one was stolen), must check new passwords against a list of known-leaked and common ones, and must allow password managers and autofill. In plain English: long and unique beats short and clever, and the only way a human keeps forty long, unique passwords is to stop memorizing them.

A password manager does that — one long master password you know, and it generates and fills the rest. It also fixes the quiet problem in most offices, which is that the Wi-Fi, the QuickBooks login and the vendor portal are all the same password, written on the same sticky note. For a business, a team plan with shared folders means the office manager can hand a new hire the logins they need and take them back the day they leave, without anyone reading a password out loud. Setup is in my password manager how-to.

Teach everyone the one rule: "We will never call you"

This is the cheapest item and the one I'd bet money saves the most. Tech-support scams — the pop-up that says your computer is infected, the call from "Microsoft," the "your bank account is compromised, let us connect and check" routine — cost Americans $2.13 billion in 2025 according to the FBI, up from $1.46 billion the year before, and they're now the third-largest loss category in the country. The FBI's fund-recovery team, which used to handle mostly business-email-compromise cases, reported a rise in tech-support and account-takeover cases in 2025. And the people who lose the most are over 60.

The rule comes straight from the FTC, which says a legitimate tech company won't call, email, or text you out of the blue to say your computer has a problem, and from Microsoft, which says it doesn't make unsolicited calls or send unsolicited emails to fix your computer. Both agree on the tell: Microsoft's error and warning messages never include a phone number, and the FTC says a real security pop-up will never ask you to call one. If a pop-up wants you to call someone, it's the scam. So the rule for your staff is one sentence: nobody who calls us about our computers gets remote access, ever — we hang up and call our own IT person at the number on the wall. That applies to me too. I don't cold-call clients about a problem on their computer. If someone claiming to be Browning PC does, hang up and call 229-561-1674.

One newer wrinkle worth knowing: in a set of August incidents that security firm Huntress wrote up this month, one attack began with a social-engineering play that got a user to open Quick Assist, the remote-help tool built into Windows. Huntress describes it as the classic tech-support scam: someone posing as support, over the phone or through a fake alert, convinces you your computer is hacked and talks you into opening Quick Assist and sharing the access code. Quick Assist is legitimate. The person asking for the code isn't. My fake text and phone scams post covers how these calls are built, and 5 Signs Your Computer Has a Virus covers what a real infection looks like next to a fake pop-up.

What is Cybersecurity Awareness Month 2026 and what is this year's theme?

It's the annual October campaign that began in 2004 under the Department of Homeland Security and the National Cyber Security Alliance and is led today by CISA, the federal cybersecurity agency, and the nonprofit National Cybersecurity Alliance. It begins Thursday, October 1, 2026. The two organizations use different themes this year: CISA's is "Securing the Next 250," tied to America's 250th anniversary, and the Alliance's is "Don't Make It Easy for Them." CISA's four core steps for everyone are avoid and report phishing, use strong passwords, use multifactor authentication and a password manager, and keep software updated; its list for businesses adds backups, logging, encryption, incident reporting and an incident response plan.

Does turning on MFA for email really stop hackers?

It stops the great majority of account takeovers. A 2023 study by Microsoft's own researchers of Azure Active Directory (now Entra ID) customer accounts found multifactor authentication reduced the risk of compromise by 99.22% overall, and by 98.56% even when the password had already leaked. An authenticator app is stronger than text-message codes, which Microsoft's data found about 40% less effective and which CISA ranks as the weakest option. Start with the owner's email and anyone who handles money.

How do I know if my business backup would actually work after ransomware?

Restore something from it. The #StopRansomware Guide from CISA, the FBI, the NSA and MS-ISAC recommends keeping an offline, encrypted copy of critical data and regularly testing that backups can be restored, because ransomware actors go looking for any backup they can reach to delete or encrypt before they lock your files. A drive that stays plugged in, or a sync folder that mirrors deletions, doesn't count. Pull a real file from the backup, open it, and put a reminder on the calendar to do it again.

Is it safe to keep using Windows 10 in my office in 2026?

Only if it's still getting security updates. Regular support ended October 14, 2025. A personal or standalone PC can enroll in Microsoft's consumer Extended Security Updates through October 12, 2027 — free with settings sync, for 1,000 Rewards points, or $30 one time — but PCs joined to a company domain, Entra, or device management aren't eligible; the business program is $61 per device the first year and doubles each year for up to three years. A Windows 10 machine with no updates keeps working but should be replaced before it fails.

How do I tell if a tech-support call or pop-up is a scam?

The FTC says a legitimate tech company will not call, email, or text you unprompted to say your computer has a problem, and Microsoft says it does not make unsolicited calls or send unsolicited emails to fix your computer. Both agree on the tell: Microsoft's error and warning messages never include a phone number, and the FTC says a real security pop-up will never ask you to call one. If a pop-up tells you to call someone, close it; if someone calls about your computer, hang up and call your own IT person at a number you already have. Never give a caller remote access or read them a Quick Assist code. Tech-support scams cost Americans $2.13 billion in 2025 per the FBI.

Does Georgia require my business to notify customers after a data breach?

Georgia's breach-notice statute, O.C.G.A. § 10-1-912, is narrower than most people assume. It applies to information brokers and to government "data collectors," covers unencrypted personal information, and requires notice "in the most expedient time possible and without unreasonable delay" rather than within a set number of days. A typical small office may fall under other rules instead — card-processor agreements, a cyber insurance policy, or healthcare regulations — each with its own clock. That's general information, not legal advice; ask your attorney which apply to you.