Happy Cyber Security Awareness Month! Technology is evolving rapidly and it’s hard to know where to begin when thinking about protecting our data. A Cyber Insurance Policy is a good line of defense once something happens, but how can we avoid an incident in the first place?
Start with an uncomfortable fact. Verizon’s 2025 Data Breach Investigations Report found that people played a role in roughly 60% of breaches, with stolen credentials and phishing-style tricks leading the way. Attackers aren’t always breaking in. Often, they’re simply logging in. That’s good news, because the most effective fixes tend to be inexpensive, predictable and consistent.
1. Use a password manager
Most of us have a handful of passwords we’ve recycled for years, maybe with a new number tacked on the end when a site forces a change. One breach at some random website then hands an attacker the keys to everything else. A password manager solves this by creating and storing a long, unique password for every account, so nobody has to memorize anything. If you’re unsure where to start, Privacy Guides keeps a vetted list of options, and it’s worth knowing that they’re a nonprofit that doesn’t earn money from recommending products or use affiliate links. In my opinion, it is worth paying for a business plan so your team can share credentials securely. That donor database login that six employees know by heart? It belongs in the password manager.
2. Turn on multi-factor authentication
Even a strong password can be stolen with one convincing email. Multi-factor authentication (MFA) adds a second step, so a stolen password alone doesn’t get anyone in the door. According to Microsoft, users who utilize MFA can prevent up to 99% of automated attacks.
Start with email, banking and any system that holds important information. If possible, avoid SMS/text authentication methods as they can be easily intercepted. Guidance backed by CISA and other security organizations says an authenticator app or hardware security key is the better choice over codes sent by text message. Many insurance carriers now ask about MFA directly on cyber applications, and your answer can affect both your coverage and your total cost of risk. Small effort, significant protection.
3. Keep software and devices updated
Updates feel like an annoying interruption… until you realize what they’re doing. Many of them close security holes that attackers already know about and actively use. The Verizon report points to vulnerability exploitation, credential abuse and phishing as the known ways in for ransomware-related breaches, which means updates cover one of those three doors on their own. Turn on automatic updates for operating systems, browsers and business apps. Then retire any device that no longer receives them.
While digital security practices can get extremely sophisticated, mastering these big 3 security practices will offer your organization the most bang for your buck in terms of protection.