Cybersecurity Awareness Month means pick three things and fix them this month: how fast you patch known vulnerabilities, how closely you watch the vendors who touch your network, and whether your team can spot a phishing attempt that arrives by text or phone instead of email. Those three areas line up with where breaches actually started this year, according to new data from Verizon’s 2026 Data Breach Investigations Report. A poster in the breakroom will not move the needle. A short list of specific fixes will.
- Vulnerability exploitation is now the initial entry point in 31% of breaches, a 55% jump from last year, and the median time to fully resolve a critical vulnerability stretched to 43 days.
- Breaches involving a third-party vendor or partner are up 60% year over year and now account for 48% of all breaches.
- Phishing attempts arriving by text or phone call had a 40% higher median click-through rate than ones sent by email.
- In the worst 2.5% of cases, a data breach ate up more than 7% of an SMB’s annual revenue.
- October 1-31 is Cybersecurity Awareness Month; CISA and the National Cybersecurity Alliance both publish free, no-cost resources any small business can use this month.
Why does Cybersecurity Awareness Month matter for a 15-person Boston company?
Because the data behind it is no longer dominated by Fortune 500 breach stories. Verizon broke down more than 22,000 breaches across 145 countries for the 2026 report, plus roughly 70,000 cyber insurance claims for a companion Breach Impact Study, and the small-business numbers are not reassuring. A Boston accounting firm, dental practice, or logistics company doesn’t need to be famous to be a target; it needs an unpatched VPN appliance, an invoice-processing vendor with weak controls, or an employee who answers a spoofed phone call. None of that requires a nation-state attacker.
Where are attackers actually getting in this year?
Vulnerability exploitation, meaning attackers using a known, often already-patched flaw in software or a network device, is the fastest-growing entry point Verizon tracked, now involved in 31% of breaches, up from roughly 20% the year before. The same 2026 Data Breach Investigations Report found the median business now takes 43 days to fully close out a critical vulnerability once it’s known, nearly two weeks longer than the year before. That gap is the window attackers use. If your IT provider can’t tell you, in plain terms, when the last critical patch went out across your servers and firewalls, that’s worth asking about this month specifically, not at the next scheduled review. Our simple IT health check walks through ten questions that surface exactly this kind of gap.
What should you fix first if you only have an afternoon?
Start with patch cadence, not a full audit. Ask your IT provider for a one-page list of what’s still unpatched on anything internet-facing: firewalls, VPN gateways, remote access tools, and public-facing web servers. Those are the systems attackers scan for automatically, around the clock, without targeting your business specifically. Second, confirm multi-factor authentication is actually enforced, not just available, on email and any remote access tool. Third, run one short phishing test that includes a text message or voicemail scenario, not only a fake email, since Verizon’s data shows those channels now outperform email for tricking people.
How much should you worry about your vendors?
More than most small businesses currently do. Breaches tracing back to a third party, a vendor, contractor, or software supplier with access to your systems, jumped 60% and now sit behind nearly half of all breaches tracked. That doesn’t mean auditing every vendor’s security program by Halloween. It means knowing which outside companies can actually reach your network or your data, and confirming at least the ones with real access use MFA and have a way to notify you quickly if they’re compromised. We covered the mechanics of this in our piece on third-party vendor risk if you want a fuller checklist.
What is CISA actually asking businesses to do this month?
CISA’s Cybersecurity Awareness Month page lists a short set of core steps for organizations of any size: use strong, unique passwords with a password manager, turn on multi-factor authentication everywhere it’s offered, recognize and report phishing, and keep software updated. The National Cybersecurity Alliance runs its own campaign this year under the message “Don’t Make It Easy for Them” and offers a free toolkit of posters and talking points if you want to run a short internal awareness push with staff. Neither requires a budget increase, just follow-through.
Frequently asked questions
Is Cybersecurity Awareness Month only relevant to large enterprises?
No. CISA and the National Cybersecurity Alliance both direct this year’s materials at organizations of every size, and the underlying breach data shows small and medium businesses absorbing a disproportionate share of the damage relative to their revenue.
What’s the single highest-impact action a small business can take this month?
Get a straight answer on how long unpatched vulnerabilities sit on internet-facing systems. That entry point grew the fastest in this year’s data, and it’s usually the cheapest gap to close.
Do phishing simulations still matter if we already use spam filtering?
Yes, and they should now include text and phone scenarios. Verizon’s 2026 data found mobile-based phishing attempts had a notably higher click-through rate than email, which most filtering tools don’t touch.
How do we know if a vendor’s access to our systems is actually a risk?
Start by listing every outside company with a login, an API connection, or remote access to your network, then confirm which of them enforce MFA. If you can’t produce that list in an afternoon, that’s the finding.
This year’s breach data points to three specific gaps: slow patching, loose vendor oversight, and phishing that skips email entirely. If you’re not sure which of those applies to your business, Boston Managed IT offers a free 15-minute Microsoft 365 and security review to find out, no sales pitch attached. Call (617) 322-5155 or visit bostonmit.com/contact to set up a time.
— Boston Managed IT
