October is Cyber Security Action Month. The National Office of Cyber Security has set the 2026 theme as “Take a second. Stay secure.” The idea is that small choices do most of the work: pausing before you click a link, share information, create a password or answer an unexpected request. (You’ll also still see it called Cyber Security Awareness Month on cyber.gov.au, which describes it as taking place every October.)
That suits a small office. You don’t need a training day. You need one habit people actually remember.
So here are four, one a week, each based on something our service desk dealt with over the past year. Each one fits in a single team chat message. Monday 5 October is the King’s Birthday public holiday in Queensland, so week one starts on the Tuesday.
Week 1, from Tuesday 6 October: report it before you delete it
The habit: if an email looks wrong, report it to IT, or use the report button in Outlook, before you delete it.
Why: deleting a phishing email protects one inbox. Reporting it means the same message can be found and removed from everyone else’s. Over the 12 months to 18 August 2026, we logged 7 tickets from 6 businesses where someone flagged a single suspicious or fraudulent message. Every one of those was a person taking a second instead of just hitting delete.
Message to post: “This week’s habit: if an email looks off, report it before you delete it. Ten seconds, and it protects everyone else’s inbox too.”
Week 2, from Monday 12 October: changed bank details get a phone call
The habit: any email that changes where money goes gets checked by phone, on a number you already had.
Why: in July 2026 a client forwarded us an invoice email demanding payment, which they’d already picked as a fraud attempt. The Australian Cyber Security Centre describes business email compromise in these terms: an email asking for an invoice to be paid or bank account details to be changed, sometimes sent from a real person’s compromised account. That last part is why checking the sender’s address isn’t enough.
Message to post: “This week’s habit: if an email changes bank details, call them on a number you already have. Never the number in the email.”
Week 3, from Monday 19 October: a breach alert means change it today
The habit: when you’re told a password has turned up in a data breach, change it that day, and anywhere else you’ve used it.
Why: in March 2026 we changed a staff member’s password after dark web monitoring reported their current password in a breach. An alert only helps if someone acts on it quickly. If the same password is used on other sites, those accounts are exposed too. The ACSC’s advice for last year’s October campaign was a unique, strong passphrase on every account and multi-factor authentication switched on, so a leaked password isn’t enough on its own.
Message to post: “This week’s habit: got a breach alert? Change that password today, plus anywhere you reused it. And check multi-factor is on.”
Week 4, from Monday 26 October: a phishing test is practice
The habit: if you click a test phishing email, treat it like a fire drill. Nobody’s in trouble, and the lesson is the whole point.
Why: in July 2026 a client asked us about phishing tests for their team. In our view tests work best when people report the suspicious emails they spot and feel fine owning up to a click. If staff are worried about getting caught out, they tend to stay quiet about the real ones as well, and the real ones are what matter.
Message to post: “This week’s habit: if you clicked a test phishing email, no drama. Read the tips, report the next one, move on.”
For the office manager
Post one message each Monday, or Tuesday in week one. Keep it to the habit and a line of why. When someone reports something during the week, thank them in the same chat. That does more for the next report than any poster on the lunchroom wall.
If a habit doesn’t fit your business, swap it for one that does. The format matters more than the exact four.
If you’d like help setting up a report button in Outlook or running a phishing test for your team, get in touch.