Topic starter
12/06/2026 10:03 pm
TL;DR: Cyber Security Awareness Month is often overwhelmed by vendor noise, but JumpCloud argues MSPs should use it to create one clear, client-facing security conversation, focusing on phishing, MFA, or password hygiene rather than broad awareness campaigns. The practical lesson is that trust-building beats feature-heavy messaging when clients need simple, actionable security guidance.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “It’s October. Our Condolences to Your Inbox.”.
Key questions
Q: How should MSPs make cyber security awareness month more effective?
A: They should narrow the campaign to one practical control outcome, then reinforce it through short conversations, simple examples, and repeatable client-ready material.
Q: Why do broad awareness campaigns often fail to change security behaviour?
A: They fail because they ask busy people to absorb too many messages at once.
Q: What are the best practices for client-facing security awareness?
A: Keep the message narrow, use a real story instead of a statistic, and make the guidance easy to reuse.
Practitioner guidance
- Choose one awareness theme Pick a single client-facing topic for the month, such as phishing, MFA, or password hygiene, and align every message to that one outcome.
- Run short client conversations Replace long campaigns with brief discussions that let clients ask questions, raise objections, and understand the one control you want them to adopt.
- Use stories instead of statistics Share one realistic client scenario that shows what happened, what changed, and which behaviour or control would have reduced the risk.
Bottom line: The article frames Cyber Security Awareness Month as a chance to reduce noise and focus clients on one useful security behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:34 am
Cyber Security Awareness Month is a governance opportunity, not a content calendar. The article is right to treat vendor saturation as noise. What matters is whether the month changes a client’s security behaviour in a way that actually reduces exposure. For identity teams, that means choosing one control outcome and making the month about adoption, not attention.
A question worth separating out:
Q: How do security teams know if security awareness training is actually working?
A: Look for reductions in susceptibility over time, improved reporting behaviour, and fewer successful phish-to-access events. A useful programme measures outcomes by cohort, role, and channel, then compares those results with authentication and incident data. If training does not change behaviour or reduce downstream compromise, it is not functioning as a control.
👉 Read our full editorial: Cyber security awareness month should drive client conversations