Cyber Awareness Dad Jokes ’26

One click on a fake login page can hand over the keys to your whole email system. Train your team to stop and verify any message that pushes urgency, money, or a password reset.

Pet names and birthdays are the first guesses attackers try, and reused passwords turn one leak into ten. A password manager or passkeys closes that door for every account at once.

Attackers with a stolen password spam approval prompts until someone taps yes just to make it stop. Use number matching, and teach staff that a prompt they didn't start means call IT, not approve.

Many attacks walk through holes that already have a fix waiting. Set updates to install automatically and check monthly that they actually did.

Keep three copies of your data, on two kinds of storage, with one offline or offsite. Then test a restore, because a backup nobody has restored is just a hopeful guess.

Dropped drives are an old trick because curiosity still works. If you find one, hand it to IT unopened, and never plug an unknown device into a work computer.

Real IT support will never ask for your password or an MFA code. Hang up and call back on a number you already know.

Cloned voices are good enough to fool a bookkeeper in a hurry. Any request to move money or share credentials gets verified on a known number, no matter how familiar the voice sounds.

Free AI tools may keep what you paste in, including client names and financials. Give your team an approved AI tool and a simple rule about what never goes into the others.

AI writes fiction in the same calm tone it writes fact. Check every number, name, and citation before it goes to a client, because they'll hold you to it, not the bot.

An AI tool connected to email, files, and payments can do real damage with one bad instruction. Give it the least access that gets the job done, and keep a human on anything that spends money.

Scammers stick fake QR codes over real ones on meters, menus, and invoices. Type the address yourself or use the official app when money is involved.

One changed account number on a real-looking invoice can send a month of payments straight to a scammer. Confirm any change to payment details by calling a number you already have on file.

Insurers now ask for proof of controls like MFA and backups, and a wrong answer on the application can sink a claim. Make sure what you told them matches what is actually turned on.

Former staff with live logins are an open door, whether they mean harm or not. Build a same-day offboarding checklist for email, apps, shared files, and door codes.

Printers, cameras, and smart TVs sit on your network with default passwords and old software. Change the defaults, update them, and keep them off the network your accounting lives on.

Your data is only as safe as the vendors who can reach it. Ask your key vendors how they protect access to your systems, and cut off the ones who can't answer.

A plan you have never practiced turns into a group text at 2 a.m. Write down who calls whom, keep a copy off the network, and walk through it once a year.

A lost laptop without encryption can turn into a reportable data breach. With full disk encryption turned on, it's just an expensive inconvenience.

Clients, insurers, and auditors ask for written policies, not good intentions. A short, honest set of written rules wins deals and speeds up every questionnaire.

Phones hold email, MFA apps, and client texts. Require a screen lock and remote wipe on every device that touches company data.

Old accounts for former staff, test logins, and forgotten services are easy targets because nobody watches them. Review every account quarterly and delete what nobody owns.

Every app someone signs up for with a work email is another place your data lives. Keep a list of approved apps and ask staff to check before they add one.

Software past its end of support never gets another security fix. Know which systems are out of support and put a date on replacing each one.