If you’re wondering how to improve cybersecurity without buying new tools, start with habits. Most breaches begin with an ordinary human moment: a reused password, a rushed click, or a computer left unlocked.
The good news is that the fixes that improve cybersecurity are just as ordinary. Below are 12 easy habits, split into two groups: everyday habits every employee can adopt today, and a few habits for business owners and IT leaders. Each takes just a few minutes, and together they close the gaps attackers rely on most.
Everyday Habits To Improve Cybersecurity
1. Lock your computer every time you walk away
This is the easiest habit to build. Whether you work in a large office or from your kitchen table, locking your screen adds a layer of protection in one second.
Picture someone talking their way into your building and finding your desk empty while you’re in a meeting. An unlocked computer gives them free rein over your email, files, and every system you’re signed in to. Lock it every time:
- Windows: press the Windows key + L
- Mac: press Control + Command + Q
Also set your device to lock automatically after a few minutes of inactivity, as a backup for the times you forget.
2. Use a unique password for every account
Reusing passwords is tempting because it’s easy to remember. But when one website is breached, attackers try those same credentials everywhere else, including your bank, email, and work accounts. This is called credential stuffing, and it works because so many people reuse passwords.
The fix is a password manager. It creates and stores a long, unique password for every account, so you only have to remember one strong master password. Choose a reputable option such as Bitwarden, 1Password, or Keeper, or ask your IT team which one your company supports. Learn more about our password management services.
What to avoid: passwords on sticky notes, in a spreadsheet, or saved in a document on your desktop.
3. Verify payment requests with a phone call or in person
If you handle accounts payable or payroll, you’re a prime target for business email compromise (BEC). In a BEC scam, an attacker impersonates an executive, vendor, or coworker and asks you to send money, change bank details, or buy gift cards. The email often looks completely legitimate and creates a sense of urgency.
Before you act on any request involving money or account changes:
- Call the person using a phone number you already have on file, never one listed in the email.
- Better yet, confirm face to face.
- Follow a written approval policy, and require a second approver for wire transfers.
Be aware that AI voice and video deepfakes can now imitate real people. A shared code word for financial requests adds protection even when a call sounds genuine. Our email security services can stop many of these messages before they reach your inbox.
4. Never share your login, even with people you trust
Even if you’ve been married to someone for 23 years, don’t give them your password. Other people have their own security habits, and sharing your login puts your account at their mercy. It also makes it impossible to tell who did what if something goes wrong.
If someone needs access, give them their own login and only the level of access they actually need.
5. Turn on multi-factor authentication everywhere
Multi-factor authentication (MFA) means a stolen password alone isn’t enough to get into your account. Check every account you use, and turn on MFA wherever it’s offered. Not all methods are equally strong.
- Passkeys or hardware security keys. This is the strongest option. These resist phishing because there’s no code to steal.
- Authenticator apps are a medium-strength choice. Microsoft Authenticator, Google Authenticator, or Duo let you choose number matching when available.
- Text message (SMS) codes. Because these can be intercepted, text messages are the weakest choice, but they’re still far better than nothing.
Watch out for “MFA fatigue” attacks, where an attacker floods your phone with approval prompts hoping you’ll tap “Approve” to make them stop. If you get a prompt you didn’t trigger, deny it and tell IT right away, because it means someone has your password.
Security questions are also hackable, since answers like your mother’s maiden name are easy to find online. If they’re required, use a made-up answer and store it in your password manager.
If a service doesn’t offer MFA at all, think twice about trusting it with your data.
6. Install updates promptly
Software updates often fix security holes that attackers are already exploiting. Delaying a restart for a week can leave a known weakness wide open.
Turn on automatic updates for your operating system, browser, and apps, and restart when prompted. For businesses, a managed software patch management program makes sure no device falls behind.
7. Pause before you click: Learn to spot phishing
Phishing is still the most common way attackers get in. Before you click a link or open an attachment, look for these warning signs:
- Urgent or threatening language, such as “your account will be closed today”
- A sender address that doesn’t quite match the real company
- Unexpected attachments, invoices, or shared files
- Requests to log in through a link instead of going to the site yourself
- QR codes in emails or flyers that lead to login pages
Don’t rely on typos to spot a fake. AI tools now help attackers write polished, convincing messages. When in doubt, go to the website directly or contact the sender another way. Learn more about our phishing protection services.
8. Report suspicious messages right away, even if you clicked
The faster IT knows about a problem, the less damage it can do. Report suspicious emails, texts, and calls as soon as you notice them.
If you already clicked a link or entered your password, report it anyway. Mistakes happen to everyone, and a quick report can be the difference between a minor scare and a full breach.
9. Be careful on public Wi-Fi
Free Wi-Fi at coffee shops, airports, and hotels is convenient, but you can’t be sure who else is on the network or who set it up. Fake hotspots with official-sounding names are common.
When working away from the office, use your phone’s personal hotspot or your company’s VPN. Avoid logging in to sensitive accounts on open networks.
Habits for Business Owners and IT Leaders
10. Back up important data with the 3-2-1 rule
Backups are your best defense against ransomware, hardware failure, and accidental deletion. Follow the 3-2-1 rule:
- Keep 3 copies of your data
- Store them on 2 different types of media
- Keep 1 copy offsite or in the cloud, ideally one that can’t be changed or deleted
Just as important, test your backups regularly. A backup you’ve never restored is a backup you can’t count on. Explore our backup and disaster recovery services.
11. Give people only the access they need
Everyday work shouldn’t happen on an administrator account. If malware runs while someone is signed in as an admin, it can install software, change settings, and spread across the network.
Give each person a standard account for daily tasks and a separate admin account only if their role requires it. Review access when people change roles or leave the company, and remove what’s no longer needed.
12. Set clear rules for AI tools
AI assistants are now part of everyday work, creating a new risk. When employees paste client data, financial records, or internal documents into unapproved AI tools, that information can leave your control.
Decide which AI tools are approved, and explain what kinds of data can and can’t be shared with them. Approved business tools such as Microsoft Copilot keep your data inside your organization’s security boundaries.
Make These Habits Stick with Training
Habits only work if people know them. Short, regular security awareness training, including simulated phishing tests, keeps these practices fresh and shows you where your team needs more support.
Learning how to improve cybersecurity doesn’t require a big budget or a technical background. It takes a handful of good habits, practiced every day by everyone on your team. Pick two or three from this list to start this week, then add more as they become second nature.
Not sure where your team stands? Schedule a Cyber Risk Assessment and get a clear plan to close your biggest security gaps.
Frequently Asked Questions
What is the easiest way to improve cybersecurity?
Turning on multi-factor authentication is the single easiest high-impact step. It takes a few minutes per account and stops attackers even when they have your password. Locking your computer whenever you step away is a close second.
How can a small business improve cybersecurity on a budget?
Focus on low-cost habits first: MFA on every account, a business password manager, automatic updates, tested backups, and regular staff training. Then get a cyber risk assessment to find your biggest gaps, so you spend money where it matters most.
How often should employees get security awareness training?
Most organizations benefit from short training sessions every month or quarter, plus regular simulated phishing tests. Frequent, bite-sized training keeps security top of mind far better than a single annual session.
Habits are the foundation, but they work best alongside the right tools and monitoring. If you’re not sure where your organization’s gaps are, ACC can help.
Editor’s note: This article was originally published on May 31, 2022, and has been updated for freshness and accuracy.
