Cybersecurity Awareness Month 2026: a four-week plan for your team

October is Cybersecurity Awareness Month. Here is a plan a small business can run in about 30 minutes a week, built around the scams hitting small teams now: AI-written phishing, deepfake voices, fake invoices and QR codes.

Want it ready to present? The Security Awareness Kit ($299) and the AI Literacy Training Pack (from $149) have the decks, quizzes, certificates and records.

The four-week plan

Week 1 (1 to 7 October): the basics. CISA's Secure Our World campaign boils security down to four habits: recognise and report phishing, use strong passwords and a password manager, turn on multi-factor authentication (MFA), and update software. Have everyone take the free 10-question security awareness quiz, and switch on MFA for email first. Source: Cybersecurity and Infrastructure Security Agency (CISA): Secure Our World.
Week 2 (8 to 14 October): phishing now that AI writes it. Spelling mistakes no longer give phishing away. Teach people to judge the request, not the writing, with the AI-written phishing lesson, and share the free "Is this email a scam?" check so anyone can test a suspicious message. Agree one way to report: a Report button or a named person.
The NCSC assessed in January 2024 that generative AI lets criminals write convincing lures without the spelling and grammar mistakes that often gave phishing away. Source: UK National Cyber Security Centre (NCSC): The near-term impact of AI on the cyber threat (24 January 2024).
Week 3 (15 to 21 October): payments, deepfakes and fake invoices. Work through the deepfake CEO voice and fake invoice lessons with everyone who can pay, approve or change bank details. Then write down two rules: a callback on a known number for any bank-detail change, and a second approver for new payees.
The FBI's IC3 counted 305,033 business email compromise incidents worldwide and $55,499,915,582 in exposed dollar losses between October 2013 and December 2023. Source: FBI Internet Crime Complaint Center (IC3): Business Email Compromise: The $55 Billion Scam (Alert I-091124-PSA) (11 September 2024).
Week 4 (22 to 31 October): QR codes, AI tools, and proof. Finish with the QR code phishing lesson and the free AI & agent safety check (what not to paste into AI tools, prompt injection, approving what agents do). Everyone takes the AI Scam Defense quiz and prints their certificate; keep a list of who completed it.

Free for your team this month

AI Scam Defense: 4 lessons (Deepfake CEO voice and video calls, Fake invoices and business email compromise, QR code phishing, AI-written phishing), a 12-question quiz and a printable certificate.
Is this email a scam? Paste an email and see each warning sign, explained. Nothing is uploaded.
Security awareness quiz: 10 questions with instant answers, and a version to download for your team.
AI & agent safety check, with what the EU AI Act's AI literacy article asks of employers.
The 8 security awareness training topics every team needs.

Everything ready to present

The Security Awareness Kit covers the whole programme (8 modules, about 55 minutes); the AI Literacy Training Pack covers AI tools, agents and deepfake payment scams (6 modules, about 43 minutes). The bundle includes the pack for up to 50 staff.

Questions

When is Cybersecurity Awareness Month?

Every October. In the US, CISA publishes the campaign and a free toolkit: Cybersecurity and Infrastructure Security Agency (CISA): Cybersecurity Awareness Month.

Do we have to buy anything?

No. Everything in the four-week plan uses free tools on this site: the security awareness quiz, the AI Scam Defense module and certificate, the email check and the AI & agent safety check. The kits save you the preparation: a presentable deck, a full quiz bank, a policy and a tracker.

How much time does it take?

About 30 minutes a week for most staff: one short session or lesson, one quiz, and one change to how you work (for example, a callback rule for payments). The AI Scam Defense lessons take about 23 minutes in total.

Does this make us compliant with a framework?

No training page can certify that. The plan gives you training that fits current scams and a record of who completed it, which is what customers, auditors and cyber insurers usually ask to see.

Sources

Sources checked 30 September 2026.