# Cyber Security Awareness Month kit > A four-week plan for Cyber Security Awareness Month in October, using free Australian posters, staff tips and ready-to-send comms. Source: https://www.malware.com.au/awareness-month/ Last updated: 2026-08-25 --- October is Cyber Security Awareness Month. This is a plan you can run in about two hours total, because everything it needs is already written. One topic a week, one poster, one short email. No training module, no completion rates, no quiz. **What ASD is doing in 2026.** Awareness Month still runs every October, but ASD's own emphasis has moved to [Cyber Action Year](https://www.cyber.gov.au/business-government/cyberactionyear2026), on the grounds that awareness by itself is not enough. That is a fair criticism, and this page agrees with it: the four weeks below are aimed at reporting speed, which is an incident-response control, rather than at hoping people stop clicking. The topics and posters here are ours, so they do not track ASD's weekly themes and do not need to. ## Before October, about an hour - Print the [posters](/awareness/). A3 for corridors and kitchens, A4 beside printers and in meeting rooms. Use the light version unless you enjoy replacing toner. - Put [how to avoid malware](/avoid-malware/) on your intranet, or link it. - Copy the five emails from [ready-to-send comms](/staff-comms/) into drafts and fill in the bracketed bits once. - Tell your leadership team what is coming, in one paragraph, so the messages do not arrive unexplained. - Decide who staff should ring, and check that number is answered. ## The four weeks | Week | Topic | Poster | Why this one | | --- | --- | --- | --- | | 1 | Stop, check, report | Stop. Check. Report. | Sets the tone: reporting fast matters more than never clicking. | | 2 | Spotting a fake email | Six signs it is phishing | The most common thing staff will actually face. | | 3 | Passwords and MFA | Not all MFA is equal | Where the biggest security gain per unit of effort sits. | | 4 | If you think you clicked | Think you have been hit? | Ends the month on the behaviour you most want. | **Week 5, if October is long enough:** payment fraud, aimed at finance and accounts only. Use the payment fraud template from [ready-to-send comms](/staff-comms/). It is the highest-value message in the set and it deserves its own week rather than being buried in a general one. ## How to send it Same day each week, early. Subject lines that say what is inside. One action per email, and the same closing line every time: **ring this number, you will not be in trouble.** Resist adding a fifth and sixth topic. Four things people remember beats twelve they skim. ## What to measure Not completion rates. They measure compliance with your training system, not security. Measure these instead: - **Reports from staff, per week.** This should go **up**, and an increase is success rather than a problem. A rise in reports means people are telling you things they previously sat on. - **Time from a suspicious email arriving to the first report.** The number that actually predicts how bad your next incident is. - **How many reports turn out to be nothing.** Should be most of them. If it is not, people are still filtering themselves and only reporting the obvious. If reports do not increase, the problem is rarely awareness. It is usually that somebody was made to feel stupid once. ## What this does not fix Worth saying plainly, especially to a board. The two most common ways malware gets in are **stolen credentials** and **unpatched internet-facing systems**, and neither involves a user mistake. An awareness month cannot touch either. What it genuinely improves is reporting speed, which is a response control rather than a preventive one, and a valuable one. Run it, and run [the Essential Eight](/essential-eight/) as well. Do not let the month become evidence that awareness is the strategy. ## Licence Everything here is CC BY 4.0. Print it, adapt it, put your logo on it, send it under your own name. Internal emails need no attribution at all. ## Common questions ### When is Cyber Security Awareness Month in Australia? October, in line with the international campaign. There is national activity through the month, so October is when internal messaging gets the most attention and the least resistance, though ASD now frames its own work as Cyber Action Year rather than as a single month. ### How much time does an awareness month actually take? Done this way, about two hours in total: one hour of setup before October and roughly fifteen minutes a week to send an email that is already written. The posters and the templates are the work, and they already exist. ### Does security awareness training actually work? Training alone does not stop the two most common ways in, which are stolen credentials and unpatched internet-facing systems, and neither involves a user mistake. What awareness genuinely improves is reporting speed, and reporting speed is what limits damage. Treat it as an incident-response control, not as prevention, and pair it with the Essential Eight. ## Primary sources - [ASD: Cyber Action Year 2026](https://www.cyber.gov.au/business-government/cyberactionyear2026) - [ASD: Take action this Cyber Security Awareness Month (October 2025)](https://www.cyber.gov.au/about-us/view-all-content/news/take-action-this-cyber-security-awareness-month) --- General information only, not legal advice. Whether an obligation applies turns on facts about your organisation and the incident. Check the primary sources above and obtain legal advice. Emergency: Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371), 24/7.