Cyber security awareness month should drive client conversations

At a glance

What this is: This is a JumpCloud perspective piece arguing that Cyber Security Awareness Month should be used by MSPs to start one practical client security conversation, not a flood of vendor-driven content.

Why it matters: It matters because IAM and security teams supporting clients need to convert awareness campaigns into concrete behaviour change around phishing, MFA, and password hygiene.

Context

Cyber Security Awareness Month often produces more messaging than measurable change. The governance gap is not a lack of information, but the absence of a simple client conversation that turns general awareness into a specific control or behaviour.

For MSPs and other identity practitioners, the practical question is how to translate awareness into action without overwhelming clients. In this article, JumpCloud frames that as a focus on one theme, one audience, and one outcome rather than a broad campaign.

That makes this a human identity and access management problem as much as a communications one. The strongest guidance is the kind that improves authentication behaviour, reduces phishing exposure, and makes security advice usable for non-specialists.

Key questions

Q: How should MSPs make cyber security awareness month more effective?

A: They should narrow the campaign to one practical control outcome, then reinforce it through short conversations, simple examples, and repeatable client-ready material. The goal is not to produce more content. It is to move one behaviour, such as MFA adoption or phishing resistance, into regular client practice.

Q: Why do broad awareness campaigns often fail to change security behaviour?

A: They fail because they ask busy people to absorb too many messages at once. If the audience cannot quickly see what action matters, the campaign becomes background noise. Security behaviour changes when the message is narrow, relevant, and tied to one control the client can actually adopt.

Q: What are the best practices for client-facing security awareness?

A: Keep the message narrow, use a real story instead of a statistic, and make the guidance easy to reuse. The most effective awareness efforts feel like help, not a lecture. That approach improves adoption because clients can understand the risk and act on the advice without extra translation.

Q: How do security teams know if security awareness training is actually working?

A: Look for reductions in susceptibility over time, improved reporting behaviour, and fewer successful phish-to-access events. A useful programme measures outcomes by cohort, role, and channel, then compares those results with authentication and incident data. If training does not change behaviour or reduce downstream compromise, it is not functioning as a control.

Technical breakdown

Why one-theme campaigns work better than broad awareness drives

Cyber security awareness campaigns fail when they try to cover too many behaviours at once. A single theme gives the audience one decision to remember, one message to repeat, and one control to reinforce. In practice, that means shifting from general education to a specific access or behaviour outcome such as MFA adoption or phishing recognition. For MSPs, the technical value is not the volume of content but the clarity of the control being changed.

Practical implication: anchor awareness activity to one measurable control outcome instead of running a generic month-long education campaign.

Phishing, MFA, and password managers as identity controls

The article’s suggested themes are all identity controls in disguise. Phishing awareness reduces credential capture, MFA raises the cost of account takeover, and password managers support unique credential use at scale. These are not abstract best practices. They are specific mechanisms that change how authentication risk is handled for human users. In a client environment, the question is which control can be adopted, explained, and sustained with the least friction.

Practical implication: choose the identity control that your clients can operationalise quickly and support consistently.

Conversation beats lecture in human identity programmes

Human users usually change behaviour when advice feels relevant, local, and actionable. A short conversation, a story about a realistic incident, or a reusable one-page guide often has more operational value than a long awareness document. That matters because identity security depends on repeatable behaviour, not just policy. For MSPs, the delivery model is part of the control environment: if clients do not understand the advice, they will not adopt it.

Practical implication: package identity guidance into short, repeatable conversations that clients can absorb and act on.

NHI Mgmt Group analysis

Cyber Security Awareness Month is a governance opportunity, not a content calendar. The article is right to treat vendor saturation as noise. What matters is whether the month changes a client’s security behaviour in a way that actually reduces exposure. For identity teams, that means choosing one control outcome and making the month about adoption, not attention.

The strongest awareness programmes are control programmes in disguise. Phishing, MFA, and password management are not marketing themes. They are human identity controls that reduce account takeover risk, improve authentication quality, and narrow the path from curiosity to compromise. Practitioners should judge the month by whether it shifts behaviour, not by how much collateral was shipped.

Trust is the medium, not the message. MSPs are more effective when they translate security into something a client can act on quickly and confidently. That is especially true in human IAM, where the value comes from adoption at the edge of the organisation, not from the volume of the explanation. The practitioner lesson is to simplify until the control is usable.

Awareness fatigue is itself a security signal. When every vendor uses the same month to push the same broad message, clients stop listening. That does not just reduce campaign effectiveness. It also shows that security education has drifted away from the operational realities of the audience. The answer is narrower guidance tied to real user behaviour.

Partnership framing beats product framing because identity change is relational. Clients adopt guidance from the people they trust to interpret risk for their environment. That makes client-facing security education a governance exercise, not a distribution problem. The implication for MSPs is to lead with relevance, not volume, and to treat awareness as part of service delivery.

What this signals

Cyber Security Awareness Month works only when it is converted into a client decision, not a marketing moment. For MSPs, that means narrowing the programme to one control and one audience segment, then repeating the same practical message until it sticks. The measure of success is whether clients change behaviour, not whether they consume more content.

Human identity programmes break when advice is too broad to act on. MFA, phishing resistance, and password hygiene are simple controls only if the guidance is simple enough to follow. The practitioner lesson is to design awareness as an operational service, with a clear outcome and a short path to adoption.

For practitioners

• Choose one awareness theme Pick a single client-facing topic for the month, such as phishing, MFA, or password hygiene, and align every message to that one outcome.
• Run short client conversations Replace long campaigns with brief discussions that let clients ask questions, raise objections, and understand the one control you want them to adopt.
• Use stories instead of statistics Share one realistic client scenario that shows what happened, what changed, and which behaviour or control would have reduced the risk.
• Offer reusable client content Create simple, branded or lightly editable material that clients can send internally without needing a separate security writer or designer.
• Tie awareness to a measurable control Define success as an observable behaviour change, such as MFA adoption or reduced phishing susceptibility, not as content volume or email opens.

Key takeaways

• The article frames Cyber Security Awareness Month as a chance to reduce noise and focus clients on one useful security behaviour.
• Its practical advice centres on human identity controls such as phishing awareness, MFA adoption, and stronger password practices.
• For MSPs, the real test is whether the month produces a change in client behaviour that improves trust and reduces account compromise risk.

Key terms

• Security awareness campaign: A planned effort to change user behaviour through repeated security messaging, examples, and reminders. In practice, the campaign only works when it drives a specific action such as MFA adoption, phishing resistance, or stronger password habits, rather than trying to teach every security topic at once.
• Phishing Resistance: Phishing resistance is the ability of a user and an authentication process to withstand impersonation attempts and malicious requests. It depends on stronger verification habits, safer authenticators, and workflows that make it harder to accept fraudulent prompts.
• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Password Hygiene: Password hygiene is the practice of creating, storing and using passwords in ways that reduce compromise risk. It includes length, uniqueness, blocklisting common secrets and avoiding reuse across systems. In mature programmes, it is treated as a governance issue, not only a user-behaviour issue.

Deepen your knowledge

Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.