What are the lessons of Cybersecurity Awareness Month?

This year's National Cybersecurity Alliance Cybersecurity Awareness Month theme, “Don’t make it easy for them,” asks us to look beyond today’s cyber risks by building good habits into our everyday routines. Practicing those habits consistently can make life harder for cybercriminals.

While technology continues to transform how we work and communicate, one thing remains unchanged: Strong cybersecurity starts with people. The theme is also a reminder that cybersecurity is not just about responding to today's attacks. It's about building preventive habits, awareness and resilience that can stand the test of time.  

For more than 20 years, Cybersecurity Awareness Month has aimed to do exactly that by educating individuals and organizations on how to recognize threats and reduce risk. But as cybercriminals adopt new tactics, technologies and increasingly AI-powered attacks, an important question remains: Has all of this awareness actually changed behavior and improved security outcomes?

BBC news featured a quote from Sam Altman, CEO of OpenAI in the fall of 2026 that summed up the questionable value of awareness in the age of AI saying, "It doesn't take as much imagination as it used to for [us] to imagine how this could go wrong.” He added, “I think the world is right to be afraid of this." 

Those concerns are understandable. As AI makes phishing, impersonation and social engineering attacks more convincing and scalable, it can seem as though cybercriminals have gained the upper hand. But before concluding that awareness efforts have lost their value, it's worth examining whether users are actually better prepared than they were in the past. 

In terms of knowledge, users are more aware than before. The Acronis Data Privacy Report 2025 found that two-thirds of consumers (68%) say they use strong, unique passwords, and 46% have adopted two-factor authentication (2FA). That’s a notable improvement compared to 2019, when Pew Research found that only about a quarter of adults in the U.S. could even identify an example of 2FA. 

Meanwhile, managed service providers (MSPs) remain a major target. According to the Acronis Cyberthreats Report H2 2025, phishing was the leading entry point for attacks on MSPs, accounting for 52% of incidents. Email-based attacks also increased year over year by 16% per organization and 20% per user. 

Attackers are also expanding beyond email. Advanced attacks on collaboration platforms rose from 12% in 2024 to 31% in 2025, signaling a shift toward high-impact secondary channels. At the same time, cybercriminals are using AI to scale proven tactics such as phishing, social engineering and ransomware rather than invent entirely new attack methods.

Still, both cybersecurity awareness and cybersecurity behavior have a long way to go. 

For example, the Acronis survey on data privacy found that 30% of consumers still find security tools too hard to use, and 35% don’t back up data regularly. Users under 35, despite being digitally savvy, reported more data breaches than those aged 55–64. 

Passwords also remain a sticking point. According to an information security researcher at Cybernews, only 6% of passwords are unique, leaving users with non-unique passwords vulnerable to dictionary attacks (password cracking). Security hangs in the balance of two-factor authentication — and only if its enabled. Reuse the same few passwords everywhere and those shortcuts undo much of the progress made in awareness. 

The 2026 theme, "Don't make it easy for them" is a reminder that the habits we build today will shape the world's digital resilience for generations. That makes password shortcuts more than a personal risk and they undermine much of the progress made through cybersecurity awareness efforts. People may understand that passwords should be long, unique and difficult to guess, but when they reuse short or familiar passwords for convenience, they leave accounts exposed to credential stuffing, dictionary attacks and password cracking. If cybersecurity awareness is meant to help protect the businesses, communities and critical infrastructure we will rely on for years to come, then strong password habits cannot remain optional. Awareness only strengthens security when it becomes consistent behavior. 

Findings from the Acronis Cyberthreats Report H2 2025 and Acronis Data Privacy Report 2025 show that security awareness remains imperative as cyberthreats evolve and risky behaviors persist. Cybersecurity Awareness Month and this year's theme “Don't make it easy for them” initiative reinforce the critical role that informed, security-conscious people play in defending the businesses, communities and critical infrastructure the world will rely on for generations. 

Acronis Security Awareness Training helps organizations turn that need into action through engaging, bite-sized lessons and realistic phishing simulations focused on modern threats, including AI-powered phishing and social engineering. By making training practical, current and easier to manage, organizations can reduce security fatigue and build the everyday habits CISA recommends, such as recognizing phishing, using strong passwords, enabling multifactor authentication and keeping software updated. 

The Acronis Cyber Platform supports service providers and businesses in keeping with the "Don't make it easy for them" theme. Preparing people to make safer decisions today helps organizations protect the businesses, communities and critical infrastructure in the future. Combined with effective security technology and a culture that reinforces safe behavior, continuous training can turn awareness into long-term cyber resilience.