In short: Cyber Security Awareness Month is an annual October campaign, hosted in the US by CISA and mirrored in Europe by European Cybersecurity Month. A simple four-week plan covers phishing and reporting, passwords and MFA, social engineering and payment fraud, then devices and updates, with a simulation, a quiz and a report-button push.
What Cyber Security Awareness Month is
Cybersecurity Awareness Month runs every October. In the United States it is hosted by CISA, the national cyber security agency, which publishes a toolkit so organisations can run their own campaigns; the 2026 theme is "Securing the Next 250". In Europe, ENISA and the European Commission coordinate European Cybersecurity Month, also each October, under the motto "Think Before U Click".
There is nothing to sign up for in the UK. The value is the timing: a month when news, suppliers and colleagues are all talking about security gives your own campaign a natural hook. If October has already passed, you can plan for next year or choose a campaign month of your own: the plan below works in any month.
CISA's core steps for everyone make a neat backbone for four weeks: avoid and report phishing, use strong passwords, turn on MFA with a password manager, and keep software up to date. CISA also publishes a free toolkit of graphics and presentations you can adapt.
The four-week plan at a glance
| Week | Theme | Key message | Activity |
|---|---|---|---|
| 1 | Phishing and reporting | If in doubt, report it, even if you clicked | Launch the report button push and a baseline phishing simulation |
| 2 | Passwords and MFA | Long passphrases, a password manager and never approving a prompt you did not start | Password manager drop-in session; MFA check for every account |
| 3 | Social engineering and payment fraud | Verify any unusual request on a second channel | Finance and executive briefing on invoice fraud and deepfakes |
| 4 | Devices, updates and wrap-up | Update promptly, lock screens and report lost devices fast | Quiz, results and thank-you to top reporters |
Keep each week's content short: one five-to-ten-minute module, one message from a leader, and one activity. People are busy, and a light touch every week beats one long session.
Week by week
Week 1: phishing and reporting
Open with a short message from the chief executive explaining why the month matters and that reporting is always welcome. Make sure everyone has the report button, explain what happens to a report, and run a realistic baseline phishing simulation with instant teaching for anyone who clicks. Share how to report a phishing email, including forwarding suspicious emails to the NCSC at report@phishing.gov.uk and scam texts to 7726.
Week 2: passwords and MFA
Cover passphrases, password managers and MFA fatigue, where attackers send repeated prompts until someone approves one. Run a drop-in session to help people set up a password manager, and check MFA coverage behind the scenes. See password and MFA training and, for the technology, Cisco Duo MFA.
Week 3: social engineering and payment fraud
Focus on impersonation by email, phone, Teams and video: fake suppliers changing bank details, "CEO" payment requests and cloned voices. Run a short briefing for finance and the leadership team on call-back verification. See business email compromise training and AI phishing and deepfake awareness.
Week 4: devices, updates and wrap-up
Remind people to install updates promptly, lock screens, use secure Wi-Fi when working remotely and report lost devices immediately. Close with a cyber security awareness quiz, share the month's results (report rate up, time to report down) and thank the people who reported most.
Ready-to-use resources
You do not need to write everything yourself:
- NCSC Top Tips for Staff: a free course of under 30 minutes, with no login, covering phishing, passwords, securing devices and reporting incidents. A downloadable version can be loaded into your own learning system. See free security awareness training
- Your platform's library: most platforms we supply have short modules on each of these themes, plus simulation templates and posters. See the vendors hub
- Engagement ideas: lunch-and-learns, newsletters, champions and friendly leaderboards. See security awareness ideas and activities
Avoid scare tactics. The NCSC advises positive messages about what people can do, because fear tends to switch people off.
After the month: keep it going
An awareness month is a launch, not a programme. Use the momentum to set up the habits that last:
- Keep a short module and a varied simulation every month for the rest of the year
- Track report rate and time to report each month, and share progress; see how to measure security awareness training effectiveness
- Recruit the most engaged people as security champions; see building a positive security culture
- Enrol new starters automatically so they do not miss out; see security induction training for new starters
- Plan the next 12 months; see how to build a security awareness training programme
If you would like the month, and the year after it, run for you, our managed security awareness training service schedules the content, runs the simulations and reports the results. Contact us to plan your campaign.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
When is Cyber Security Awareness Month?
It runs every October. In the US it is hosted by CISA, and in Europe ENISA and the European Commission run European Cybersecurity Month in the same month. Organisations in the UK can join in or run their own campaign at any time of year.
What is the theme of Cybersecurity Awareness Month 2026?
CISA's 2026 theme is "Securing the Next 250". Its core behaviours remain recognising and reporting phishing, creating strong passwords, turning on MFA and using a password manager, and keeping software up to date.
What activities can we run for Cyber Security Awareness Month?
Good options include a report-button push with a phishing simulation, a password manager drop-in, a payment fraud briefing for finance, a lunch-and-learn, a short quiz, a leader's story about a phish they nearly fell for, and recognising the people who reported most.
Can we run a cyber security awareness month outside October?
Yes. The plan works in any month. Some organisations choose a quieter month so the campaign does not compete with year-end or other events, or run a shorter awareness week each quarter.
Is there a UK Cyber Security Awareness Month?
The best-known campaigns are CISA's in the US and European Cybersecurity Month across the EU. UK organisations commonly use October as a hook and draw on free NCSC material such as Top Tips for Staff.