PhishSheriff
Security analyst monitoring systems at night

Cybersecurity Awareness Month

Cyber Awareness Month 2026

Four weeks. Four habits. Four games. Everything your team needs to make security stick.

A team reviewing a security alert together
Every OctoberSince 2004Observed worldwide

What is Cyber Awareness Month?

One month to build habits that last all year.

Every October, organisations around the world use Cybersecurity Awareness Month to help people recognise attacks, protect their accounts and report anything suspicious.

It began in the United States in 2004 as a joint effort between government and industry, and is now observed worldwide — including as European Cybersecurity Month across the EU.

Most attacks still start with a person: an email, a call or a message designed to make someone act before they think. That is why the month focuses on everyday habits, not technical controls.

On this page

01

Recognise

Spot phishing, fraud and manipulation — by email, phone, text or video.

02

Verify

Check unusual requests on a second channel before acting on them.

03

Report

Tell security straight away. Fast reports shut attacks down sooner.

The four weeks

One theme. One habit. Every week.

Week 1

Phishing

Pause and check before you click.

Week 2

Financial Fraud

Confirm every payment or bank-detail change on a second channel.

Week 3

Social Engineering

When someone rushes you, slow down and confirm who they are.

Week 4

AI-Powered Scams

Don’t trust a voice or video alone — verify big requests.

Games

Play. Learn. Compete.

Four games your team can play in the browser — no download, no sign-up.

Free month kit

Download the complete Cyber Awareness Month kit.

Everything you need to run all four weeks, in one free download. Enter your details and the download starts straight away.

  • Week 1 · Phishing
  • Week 2 · Financial Fraud
  • Week 3 · Social Engineering
  • Week 4 · AI-Powered Scams

For any customisation request, reach out to us at cs@phishsheriff.com.

How to run it

Five steps. That’s the whole plan.

A team planning together in a meeting room
  1. 1

    4 weeks before

    Set one goal

    Pick one behaviour to improve, such as reporting suspicious emails.

  2. 2

    3 weeks before

    Measure a baseline

    Run a phishing simulation before any training.

  3. 3

    2 weeks before

    Get leadership on board

    Ask an executive to open the month on October 1.

  4. 4

    During October

    One theme a week

    An email on Monday, a game midweek, recognition on Friday.

  5. 5

    End of October

    Report the results

    Compare with your baseline and share one page with leadership.

The guide for security leaders

10 Cybersecurity Awareness Month Ideas (2026): Activities & Tips for Security Leaders

Practical activities that fit into a normal working week. Each one comes with how to run it, why it works, and one tip to make it land.

01Week 1

Open with a leadership kickoff

A two-minute message from your CEO or CISO on October 1 sets the tone: this matters, and everyone has a part to play.

How to run it

  1. 1Draft a short script with a single ask: report anything suspicious.
  2. 2Record it on a phone — authenticity beats polish.
  3. 3Share it on October 1 through your most-read channel: all-hands, intranet or Teams.

Why it works

People take security seriously when leadership visibly does. A named executive also makes every later message easier to trust.

Tip: Keep it under two minutes and end with one clear ask.

02Week 1

Measure a baseline in week one

Run an unannounced phishing simulation before any training, so you have a real starting point to compare against at the end of the month.

How to run it

  1. 1Choose a realistic lure that fits your industry.
  2. 2Send it to everyone in the first week, before any training goes out.
  3. 3Record the click rate, the reporting rate and the time to the first report.

Why it works

Without a baseline you can show activity, not improvement. With one, you can show leadership exactly what changed.

Tip: Don’t announce the date — a warned audience gives you a misleading baseline.

03All month

Give every week one theme

One topic per week — phishing, financial fraud, social engineering, then AI-powered scams — keeps the message simple enough to remember.

How to run it

  1. 1Give each week a theme and a one-line habit.
  2. 2Align every email, poster and game that week to the theme.
  3. 3Repeat the habit line everywhere: signatures, banners and meetings.

Why it works

One repeated idea beats a flood of content. People remember a habit, not twenty tips.

Tip: Write the habit as an action: “Pause and check before you click.”

04Any week

Swap the lecture for a game

A ten-minute game at the start of a team meeting teaches more than an hour of slides — and people actually want to join in.

How to run it

  1. 1Pick one of the games on this page for the week.
  2. 2Play it on a shared screen at the start of a team meeting.
  3. 3Have the team call out their answers before you reveal them.

Why it works

Games create discussion, and discussion is where people learn to spot the tells.

Tip: Let the team argue over each answer — the debate is the learning.

05All month

Reward reporting, not perfection

Make reporting suspicious messages the behaviour you celebrate — including reports of simulated phishing.

How to run it

  1. 1Award points for every report, whether it’s a simulation or real.
  2. 2Publish a friendly weekly leaderboard by team.
  3. 3Thank the earliest reporters publicly every Friday.

Why it works

Reporting is the behaviour that shortens an attacker’s window. Punishing clicks makes people hide mistakes; rewarding reports makes them speak up.

Tip: Never shame the people who click — praise the people who report.

06Week 4

Show a deepfake, live

Show how easily a voice or a face can be cloned. Seeing it once changes how people react to urgent calls.

How to run it

  1. 1Use a sample from a volunteer who has given consent, such as an executive’s voice.
  2. 2Play the real and cloned clips side by side and ask people to guess which is which.
  3. 3Finish by agreeing a verification step for urgent requests.

Why it works

Most people believe they could tell the difference. A live demo removes that confidence, safely.

Tip: Agree a verification phrase or a call-back rule for payment requests.

07Week 3

Run a vishing drill for high-risk teams

Finance, HR and the service desk take the most attacker phone calls. Give them a realistic simulated call and a quick debrief.

How to run it

  1. 1Pick the teams that handle payments, payroll or password resets.
  2. 2Run a short simulated call with a realistic pretext.
  3. 3Debrief within 24 hours: what worked, and what to say next time.

Why it works

Phone-based social engineering bypasses email filters entirely — and it targets the people with the most access.

Tip: Give teams a line for saying no: “I’ll call you back on the number we have on file.”

08All month

Put security where people already look

Use the places people look every day instead of adding new channels.

How to run it

  1. 1Refresh posters in kitchens, lifts and meeting rooms.
  2. 2Add the week’s habit to Teams or Slack banners and email signatures.
  3. 3Change lock screens and screensavers every Monday.

Why it works

Awareness fades quickly. Small, frequent reminders in familiar places keep the habit top of mind.

Tip: Change the message every Monday so it never becomes wallpaper.

09Week 2

Tabletop a payment-fraud scenario

Walk finance and executives through a fake request to change a supplier’s bank details, step by step.

How to run it

  1. 1Write a realistic scenario: an urgent email asking to change a supplier’s bank account.
  2. 2Walk through it together — who receives it, who checks it and who approves it.
  3. 3Agree the call-back rule and write it down.

Why it works

Business email compromise is one of the costliest attacks organisations face. Rehearsing the decision makes the right response automatic.

Tip: Share the written call-back rule with everyone who can approve a payment.

10Week 4

Close with a board-ready read-out

End the month by comparing results with your baseline, on one page that leadership will actually read.

How to run it

  1. 1Compare the click rate, reporting rate and participation with week one.
  2. 2Highlight the teams that improved most, and where risk remains.
  3. 3Propose next quarter’s plan so the momentum continues.

Why it works

A clear before-and-after turns an awareness month into a program that leadership keeps funding.

Tip: Plan the next quarter before November starts.

FAQ

Cybersecurity Awareness Month ideas: FAQ