About Cybersecurity Awareness Hub — Phishing, Threats and Online Safety Explained

A small business usually experiences its costliest breach due to a single employee clicking on one link contained within a bogus HR email. It is not because of some sophisticated technical exploit (i.e. a zero-day attack). It is not because of state-sponsored hackers who target small businesses' infrastructure or opposing a country's political interest, rather it's merely because an employee received a phishing email, with a phishing email containing a spoofed or cloned web address that lead to a fake "dummy" site that looks like their actual company site. The reason for this occurrence is due to how simple it is to convince untrained employees into clicking on those links contained within the phishing email(s) because the person(s) sending the emails took the time to show employees what a phishing email would look like prior to them receiving one.

Cybersecurity Awareness Hub covers the threats that affect real people and small businesses: phishing, scams, malware, ransomware, password attacks, and the basics of access control and MFA. Not written for security engineers. Written for the people those engineers are trying to protect — employees, small business owners, and anyone who uses email, handles passwords, or does anything online that involves sensitive information.

3 guides worth reading first:

1. Email Phishing Explained — how to recognize the warning signs that actually distinguish real phishing from legitimate email, with specific examples.
2. Password Best Practices — what strong passwords actually require in 2026 and why password managers solve a problem most people don't realize they have.
3. How to Prevent Computer Viruses — layered protection that works without requiring technical expertise.

Why Most People Get Hacked — And It's Not What They Think

There's a persistent image of hacking that involves sophisticated code, dark rooms, and people who understand systems at a level most users never will. That image is mostly wrong. The majority of successful attacks against individuals and small businesses don't exploit technical vulnerabilities at all. They exploit human ones.

Verizon has released an annual breach report for several years and demonstrates that more than 80% of the breaches have involved a human component (whether that is through phishing, stolen login credentials, or someone making a decision they shouldn't have).

The primary reason that all attackers target people is that it's much easier to manipulate someone than it is to break into a well configured piece of software. It costs nothing for the sender to send a phishing email to 10,000 email addresses. If 0.3% of those people clicked on the email and entered their login credentials, then you now have access to 30 different accounts (of which some will have administrator level access, shared passwords, or access to financial systems). Thus, regardless of how low the success rate is on a phishing email, the attacker has a very high likelihood of having success.

That is why awareness is worth more than most forms of technology. For example, Antivirus software protects only against known pieces of Malware, while Firewalls block known unwanted traffic. None of the above listed technical controls will prevent an employee from providing their user ID or password to an attacker using a fake login page. The only way for an employee not to provide their user ID or password to an attacker using a fake login page is if the employee recognizes what is occurring. In order to recognize what is occurring, the employee must become familiar with what that type of phishing email looks like.

Phishing — The Attack That Keeps Working

Phishing emails in 2026 don't look like the obvious scams from fifteen years ago. They're not riddled with typos. They don't ask for your bank details from a Nigerian prince. The convincing ones are indistinguishable from real corporate communications — correct logos, proper formatting, the right sender name, a plausible reason for urgency.

The tells are subtler now. The sender's actual email domain is slightly wrong — "support@micros0ft.com" instead of "microsoft.com," or a legitimate-looking subdomain on a domain the attacker registered. The link in the email goes somewhere other than where it says — hovering over it before clicking shows the real destination. The request has urgency: your account will be suspended, action required within 24 hours, verify immediately. Real companies almost never communicate this way about account security.

The spear phishing type is targeted. Instead of sending mass mailings or emails, an attacker has researched and crafted an individual email to someone based on their role (and who works with them), what projects they are working on, any prior communications with them, etc. From this individual email will be a message purportedly sent from your CFO, referencing a paid vendor with whom you have done business, and asking you to provide him or her with a wire transfer to a newly opened bank account for that vendor. Since this email has personal information (imberabs) regarding the recipient, it becomes extremely difficult to determine if the emails have been sent from an actual source at the organization.

The phishing guide covers the full range — from mass phishing to spear phishing to smishing (SMS phishing) — with specific examples of what each looks like and what questions to ask before clicking or responding to anything that requests action.

Passwords — The Problem Is Reuse, Not Length

The conventional password advice — make it long, use special characters, change it every 90 days — gets one thing right and two things wrong. Length matters. Mandatory rotation every 90 days leads people to make predictable incremental changes ("Password1!" becomes "Password2!") that provide almost no security improvement. And special characters help but are secondary to length.

The real problem is reuse. A 16-character unique password on every account is far more secure than a strong password used across multiple sites. Here's why: every year, millions of username-and-password combinations from breached databases are posted publicly. Attackers run those credentials against other services automatically — a process called credential stuffing. If you use the same password for your email and your banking app, and your email provider has a breach, the banking account is now compromised too. Not because your bank was hacked. Because a different service you trusted was.

Password managers solve this completely. They generate a unique, random, long password for every account and store it encrypted. You remember one strong master password. Everything else is handled. The objection most people raise is that putting all passwords in one place is risky — which is true in principle and false in practice. The realistic threat to most people isn't a targeted attack on their password manager. It's reused passwords across services with varying security standards. A password manager eliminates that risk entirely.

Multi-factor authentication adds a second layer that protects even when passwords are compromised. An attacker who gets your password from a breach still can't log in if they also need a code from your phone. Not all MFA is equal — SMS codes are better than nothing but can be intercepted via SIM swapping. Authenticator apps are more secure. Hardware keys are the most secure. The password guide covers how to implement each level and which accounts should be prioritized.

Malware and Ransomware — How Infections Actually Happen

Most malware doesn't arrive through sophisticated exploits targeting unpatched software. It arrives through the same channels as phishing: email attachments, malicious links, and occasionally downloads from sites that look legitimate but aren't. An employee opens a Word document attached to an email that claims to be an invoice. The document prompts them to enable macros. Macros run. Malware installs. The infection spreads across the network before anyone notices.

Ransomware is the most disruptive variant. It encrypts files — documents, databases, backups — and demands payment in cryptocurrency for the decryption key. For a small business without proper backups, this is catastrophic. For a hospital or utility, it can be dangerous. The ransom demands have grown from thousands to millions of dollars as attackers have figured out what organizations will actually pay to recover.

The first line of defense against ransomware attacks is usually behavioral (not technical). You should never open attachments from unknown persons (even if they are from friends) because there could be a possibility their accounts may have been hacked. Never enable macros in documents that you're not familiar with from unknown sources. Software updates are also important because most ransomware exploits previously identified vulnerabilities that have been patched by the respective software companies. Always ensure you have antivirus software installed with active real-time scanning to catch any potential intrusions immediately. Finally, create backups of all your important data on an external hard drive disconnected from the main network, or to a cloud-based service with versioning so you can restore files that were infected prior to the infection.

The key backup point for most small businesses is something they ignore until after they’ve been impacted by a ransomware attack and incurred a loss. Having an offsite or offline backup does not stop a ransomware attack from occurring; however, it allows businesses to decide not to pay the requested ransom in order to recover their data.

Access Control — Who Can See What, and Why It Matters

The principle of least privilege sounds like jargon but describes something simple: people should only have access to the systems and data they actually need to do their job. Nothing more. An employee in accounts payable doesn't need access to HR files. A contractor working on one project doesn't need credentials that give them access to all your systems. A former employee's account should be disabled the day they leave, not left active because nobody got around to removing it.

Access controls are important to restrict the damage from an attack. If an account with limited privileges is compromised by an intruder, they will have limited access. However, if a system administrator's account is compromised there will be much more that can be done. The same applies to any type of internal threat, particularly when employees accidentally expose data because of having the wrong level of access. This is a major category of breach and often overlooked compared to breaches due to outside parties.

The least privilege guide covers how to implement this practically in small business environments — which often run on the same shared admin credentials for years because nobody wanted to manage individual permissions. That convenience has a real cost in exposure when any one of those credentials is compromised.

What Security Awareness Training Actually Does

Most corporate security awareness training is treated as a compliance exercise. Annual video, short quiz, certificate of completion, box ticked. The attack rate on organizations that do it that way doesn't meaningfully change. The training that actually moves the needle is different in structure: it runs phishing simulations that send fake phishing emails to employees, measures who clicks, and provides immediate training when someone does. Not punishment — education at the moment the mistake happened, when it's most relevant.

Organizations that run regular phishing simulations typically reduce click rates on actual phishing attempts by 60 to 70% over 12 months. That's not a small number. If your organization gets 500 phishing emails a month and 15% of employees would click without training, you're looking at 75 potential breach entry points per month. Get that rate to 4% and you've eliminated most of your most likely attack surface without deploying a single new security product.

The other thing effective training does is change what employees do after they click something they shouldn't have. If the culture is blame-and-punish, people hide mistakes. If the culture treats incidents as training opportunities, people report them immediately — which is the difference between catching an infection in hours versus discovering it months later when the damage is done. The security awareness guide covers program structure, simulation tools, measurement approaches, and the culture component that most training programs ignore.

Scams Targeting Individuals — The Variants That Work in 2026

Scams targeting individuals have adapted to current technology and current events. Tech support scams have been running for years but still catch people: a pop-up announces your computer is infected and provides a phone number to call. The "technician" who answers is a scammer who will either charge for fake services or install actual malware while pretending to fix something that wasn't broken. The tell is simple — Microsoft, Apple, and Google do not initiate contact this way. Ever.

Romance scams have scaled significantly with AI-generated content and deepfake video. Someone builds a relationship over weeks or months, usually on social media or dating apps, before the financial requests start. The requests are always framed as temporary — an emergency, a business opportunity, a wire transfer that will be returned. They never are. The FBI's 2024 figures put losses from romance scams at over $1 billion annually in the US alone.

Small businesses are the primary targets of invoice fraud. An attacker intercepts or spoofs an email conversation between the business and its supplier and alters the supplier's bank account information for payment on an open invoice. When the business submits a payment to an account controlled by the fraudster, the payment is valid. By the time the fraud is discovered, recovering the funds is extremely challenging. In order to eliminate invoice fraud you should verify all changes or adjustments in payment information via telephone using a number from your existing records, not the telephone number provided in the fraudulent email.

FAQ

Phishing guides, scam awareness, password security, MFA setup, and security awareness training resources — full archive at Cybersecurity Awareness Hub.