Topic starter
02/08/2026 12:23 pm
TL;DR: Cybersecurity Awareness Month centres on four practical controls, strong passwords, MFA, phishing reporting, and prompt patching, while CISA also stresses support for SMBs and SLTT governments that sit in critical supply chains, according to Cymulate. The real governance issue is not awareness alone but whether organisations can validate that these controls work continuously.
Editorial analysis by NHI Mgmt Group, based on content published by Cymulate: “Cybersecurity Awareness Month: Secure Our World”.
Key questions
Q: What should teams do when MFA still allows account compromise?
A: Teams should move high-risk accounts to phishing-resistant methods, restrict device enrollment, and review whether support workflows let attackers impersonate legitimate help-desk activity.
Q: Why do passwords and basic MFA still fail in real breaches?
A: Because attackers do not need to defeat the system if they can reuse, relay, or socially engineer the factor.
Q: How should security teams measure whether smishing training is actually reducing risk?
A: Measure whether employees behave differently, not whether they completed a module.
Practitioner guidance
- Test MFA enforcement across all login paths Validate primary sign-in, recovery, privileged access and application-specific flows so MFA is not bypassed through exceptions or legacy integrations.
- Run controlled password spray and credential stuffing simulations Check whether weak, reused or compromised credentials still succeed against internet-facing and internal authentication surfaces.
- Measure phishing reporting as a response control Track whether users can recognise, report and escalate suspicious messages quickly enough to support containment and triage.
Bottom line: Cybersecurity awareness is not enough on its own because resilience depends on whether passwords, MFA, phishing reporting and patching are actually enforced and validated in the environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:23 pm
Validation is now the governance test for awareness programmes. Security awareness only matters when organisations can prove that the associated controls work under realistic conditions. Password policy, MFA and phishing training should be treated as control claims that need evidence, not slogans that live in a campaign calendar. The practitioner conclusion is simple: move from stated hygiene to measurable resilience.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations validate patching or focus on awareness first?
A: Validate patching first when the risk is exploitability, because awareness does not stop a reachable vulnerability from being used. Organisations should prioritise the systems that are both exposed and exploitable, then use awareness work to support the human behaviours that keep those remediation workflows effective.
👉 Read our full editorial: Cybersecurity Awareness Month puts validation at the center of resilience