Cyber Security Awareness Month kit

October is Cyber Security Awareness Month. This is a plan you can run in about two hours total, because everything it needs is already written.

One topic a week, one poster, one short email. No training module, no completion rates, no quiz.

What ASD is doing in 2026. Awareness Month still runs every October, but ASD’s own emphasis has moved to Cyber Action Year, on the grounds that awareness by itself is not enough. That is a fair criticism, and this page agrees with it: the four weeks below are aimed at reporting speed, which is an incident-response control, rather than at hoping people stop clicking. The topics and posters here are ours, so they do not track ASD’s weekly themes and do not need to.

Before October, about an hour

• Print the posters. A3 for corridors and kitchens, A4 beside printers and in meeting rooms. Use the light version unless you enjoy replacing toner.
• Put how to avoid malware on your intranet, or link it.
• Copy the five emails from ready-to-send comms into drafts and fill in the bracketed bits once.
• Tell your leadership team what is coming, in one paragraph, so the messages do not arrive unexplained.
• Decide who staff should ring, and check that number is answered.

The four weeks

Week	Topic	Poster	Why this one
1	Stop, check, report	Stop. Check. Report.	Sets the tone: reporting fast matters more than never clicking.
2	Spotting a fake email	Six signs it is phishing	The most common thing staff will actually face.
3	Passwords and MFA	Not all MFA is equal	Where the biggest security gain per unit of effort sits.
4	If you think you clicked	Think you have been hit?	Ends the month on the behaviour you most want.

Week 5, if October is long enough: payment fraud, aimed at finance and accounts only. Use the payment fraud template from ready-to-send comms. It is the highest-value message in the set and it deserves its own week rather than being buried in a general one.

How to send it

Same day each week, early. Subject lines that say what is inside. One action per email, and the same closing line every time: ring this number, you will not be in trouble.

Resist adding a fifth and sixth topic. Four things people remember beats twelve they skim.

What to measure

Not completion rates. They measure compliance with your training system, not security.

Measure these instead:

• Reports from staff, per week. This should go up, and an increase is success rather than a problem. A rise in reports means people are telling you things they previously sat on.
• Time from a suspicious email arriving to the first report. The number that actually predicts how bad your next incident is.
• How many reports turn out to be nothing. Should be most of them. If it is not, people are still filtering themselves and only reporting the obvious.

If reports do not increase, the problem is rarely awareness. It is usually that somebody was made to feel stupid once.

What this does not fix

Worth saying plainly, especially to a board. The two most common ways malware gets in are stolen credentials and unpatched internet-facing systems, and neither involves a user mistake. An awareness month cannot touch either.

What it genuinely improves is reporting speed, which is a response control rather than a preventive one, and a valuable one. Run it, and run the Essential Eight as well. Do not let the month become evidence that awareness is the strategy.

Licence

Everything here is CC BY 4.0. Print it, adapt it, put your logo on it, send it under your own name. Internal emails need no attribution at all.