Technology Advisor Blog

October is Cybersecurity Awareness Month, and once again, Ekaru is proud to be a Cybersecurity Awareness Month Champion.

We’ve participated in the Champion program for many years because its mission closely aligns with our own: helping people and businesses understand cybersecurity and take practical steps to protect themselves.

Cybersecurity Awareness Month was started in 2004 as a collaboration between the National Cybersecurity Alliance and CISA - Cybersecurity & Infrastructure Security Agency.

For us, cybersecurity has never been about creating fear.

It’s about empowerment.

“Our mission from the beginning has been to work with local businesses to help them be more productive with technology - and to keep that technology safe. We’re delighted to once again be a Cybersecurity Awareness Month Champion and help explain cybersecurity principles in plain English. Big corporations may make the headlines, but cybersecurity is really a local issue. It affects you, your family, your employees, and the businesses in your community every day.”

— Ann Westerheim, Ekaru

Don’t Make It Easy for Them

This year, the National Cybersecurity Alliance (NCA) has a refreshingly straightforward theme for Cybersecurity Awareness Month: “Don’t Make It Easy for Them.”

Cybercriminals are constantly looking for opportunities, but that doesn’t mean protecting your business has to involve an enormous cybersecurity budget or complicated technology.

In fact, one of the most important messages from this year’s campaign is that small actions can make a big difference.

That’s a message we strongly believe in at Ekaru.

We work with local small and midsized businesses every day. We understand that business owners are balancing a lot of priorities: serving customers, supporting employees, managing costs, and growing their businesses. Cybersecurity can sometimes feel like one more complicated thing on an already long list.

It doesn’t have to be.

There are smart, affordable steps every organization can take to become significantly more secure.

A View From Our Own Community: 78,000 Failed Attacks in One Month

In just the past month, the Microsoft 365 security monitoring we manage for our local business clients recorded more than 78,000 FAILED attacks.

That number may sound alarming, but here's the important word: failed.

These attacks were unsuccessful. The number doesn't mean 78,000 accounts were compromised. Instead, it gives us a window into just how persistent cyber threats have become. Attempts to get into Microsoft 365 accounts aren't rare events reserved for large corporations. They're happening all the time - including to small businesses right here in our community.

Automated attackers don't care whether you're a Fortune 500 company or a 20-person local business. They're looking for an opportunity and an easy way in.

That's why we don't share this number to create fear. We share it because it demonstrates the value of good cybersecurity.

The goal isn't to stop attackers from trying. It's to make sure they keep failing.

That's what “Don't Make It Easy for Them” looks like in the real world.

Four Simple Ways to Make Your Business Harder to Attack

The National Cybersecurity Alliance recommends starting with four fundamental cybersecurity habits:

1. Use strong passwords and a password manager.
Reusing passwords makes a cybercriminal’s job much easier. A password manager helps employees use strong, unique passwords without having to remember every one of them.

2. Turn on multifactor authentication.
Multifactor authentication (MFA) adds another layer of protection beyond a password. For businesses using Microsoft 365 and other cloud applications, properly configuring MFA is one of the most important steps you can take to protect accounts.  Yes, MFA adds another step and can be inconvenient, but its so important.

3. Recognize and report scams.
Technology is important, but people are an important part of cybersecurity too. Teach employees to slow down when they receive an unexpected request, suspicious link, unusual invoice, or message asking them to act urgently. Just as importantly, create a culture where employees feel comfortable reporting something suspicious.

4. Keep software updated.
Updates aren't just about getting new features. They frequently fix security vulnerabilities. Keeping computers, applications, browsers, phones, and other devices current helps close doors attackers might otherwise use.

None of these steps requires your business to become a cybersecurity expert.

They simply make your organization a harder target.

AI Has Changed the Speed But Not the Fundamentals

There's another reason these basic protections matter so much right now: Artificial Intelligence is making it possible for attackers to move faster and operate at greater scale.

But faster attacks don't necessarily require an entirely new cybersecurity playbook.

As SecurityWeek recently put it: “AI Has Changed Attack Speed, Not Security Fundamentals.”

That's an important distinction for small businesses.

AI can help criminals create convincing phishing messages faster, automate parts of an attack, and increase the volume of attempts. But the fundamentals of protecting your business remain remarkably familiar.

Strong identity protection. MFA. Updated systems. Secure configurations. Backups. Employee awareness. Monitoring. And a plan for responding when something goes wrong.

 Despite the wild headlines, AI hasn’t changed the basics of cybersecurity - it has just made attackers faster and more efficient at finding the same old weaknesses. 

Cybersecurity Should Empower Your Team, Not Frighten Them

There's plenty of scary cybersecurity news out there: ransomware, data breaches, phishing, business email compromise, identity theft, and increasingly sophisticated AI-enabled scams.

Those risks are real. But fear by itself doesn't make a business more secure.

Education does | Good technology does | Good habits do.

And having someone you trust to help you make sensible decisions does.

That's why our approach at Ekaru is focused on making cybersecurity understandable and manageable. We want business owners to understand what matters, what they can do about it, and where their technology investment will make the biggest difference.

Cybersecurity shouldn't be something only an IT person can understand. It should make sense in plain English.

Small Businesses Have More Options Than They May Realize

The National Cybersecurity Alliance's 2026 Small Business Cybersecurity Awareness & Practices Survey reinforces an important message: there are practical, low-cost cybersecurity improvements businesses can make right now.

We see that every day.  Simple actions can GREATLY reduce your risk.  Risk isn't eliminated, but greatly reduced with very simple actions.

Sometimes better security means adding a new security tool. But sometimes it means properly configuring technology you're already paying for. It can mean enabling MFA, improving Microsoft 365 security settings, keeping systems patched, training employees, establishing reliable backups, or putting a process in place for what happens when someone receives a suspicious email.

Cybersecurity doesn't have to start with spending a fortune.

It starts with understanding your risks and taking the right next steps.

Cybersecurity Is Local

When a major corporation suffers a cyberattack, it makes national headlines.

But most cybersecurity doesn't happen in the headlines.

It happens when someone at a local business receives a convincing phishing email. When an employee's password is exposed. When someone gets a fake Microsoft 365 login prompt. When an invoice request doesn't look quite right. Or when a family member receives a text message designed to trick them into clicking a link.

That's why cybersecurity awareness matters to all of us.

Ekaru has been a Cybersecurity Awareness Month Champion for many years because cybersecurity education is part of our commitment to the businesses and communities we serve.

We believe local businesses deserve access to thoughtful cybersecurity guidance and strong security technology - but in a way that makes sense for their size, their budget, and the way they actually work.

And you don't have to fix everything overnight.

Start with ONE thing.

Turn on MFA. Review your backups. Update an old computer. Talk to your employees about phishing. Check the security settings in Microsoft 365. Make sure you know who to call if something suspicious happens.

Then take the next step.

That's how stronger cybersecurity is built: one smart decision at a time.

This Cybersecurity Awareness Month, Don't Make It Easy for Them.

And if you're not sure where to start, Ekaru is here to help you understand the risks, prioritize what matters, and take smart, practical steps to protect your business.

About the author: