7 cyber security habits every organisation should review this month

Cyber security is often discussed in terms of major investments: new security platforms, transformation programmes, penetration testing or incident response capabilities. But an organisation’s day-to-day cyber resilience is also shaped by something less dramatic: habits.

Accounts accumulate permissions. Updates get postponed. A backup job reports success for months without anyone testing whether the data can actually be restored. Employees become accustomed to approving authentication prompts. Security policies written for last year’s environment quietly stop reflecting how people work today.

In a constantly changing digital world, these gaps matter. Cyber criminals do not always need highly sophisticated techniques to compromise an organisation. Weak passwords, exposed systems, phishing attacks, malicious software and stolen credentials can all contribute to security incidents and data breaches.

Effective cyber security therefore depends on maintaining the fundamentals consistently. Reviewing the following seven cyber security best practices each month can help organisations identify weaknesses earlier, strengthen their security posture and significantly reduce unnecessary exposure to common cyber security threats.

If you are reading this because your organisation has experienced a cyber incident and is unsure how to respond, contact Zensec immediately.

1. Review who has access

Access builds up quickly as employees change roles, contractors leave and temporary permissions become permanent. Review administrator, dormant and third-party accounts regularly, particularly where they provide access to sensitive data or critical systems.

Apply least privilege and limit access to what each person genuinely needs. For remote working, include cloud services and personal devices in the review.

Where passwords are still required, avoid weak passwords and reuse. A password manager can support strong, unique passwords, but organisations should also look to reduce password reliance through stronger authentication.

2. Strengthen authentication

Passwords alone should not protect important systems. Enable multi factor authentication for email, cloud platforms, remote access, administrator accounts and other sensitive systems, then regularly check for gaps.

Not all authentication methods offer equal protection against phishing attacks and social engineering. Where supported, passkeys and FIDO2 security keys provide phishing-resistant authentication, reducing reliance on passwords.

Prioritise privileged accounts, where unauthorised access could have the greatest impact. Strong authentication, combined with least privilege, significantly reduces the value of a compromised credential.

3. Keep everything up to date

Automatic updates help, but they do not guarantee every device is up to date. Updates fail, systems stop reporting and unsupported applications can remain unnoticed.

Where appropriate, enable automatic updates, then regularly check for missing patches, outdated software, personal devices and IoT devices.

Prioritise internet-facing and critical systems because cyber criminals can exploit known vulnerabilities to gain access or deliver malicious software. Firewalls, endpoint protection and intrusion detection systems also need monitoring and maintenance.

Good network security starts with knowing what technology you have and whether it is properly protected.

4. Test your backups

Having backups is not the same as knowing you can recover. Carry out regular backups, but also restore important data periodically to confirm it is available, usable and recoverable within an acceptable timeframe. That applies whether backups are stored locally or in a cloud based storage system.

This is particularly important during ransomware attacks, where cyber criminals may target both production systems and recovery copies.

Protect backup environments with appropriate access controls and separate credentials where possible. The question should not simply be, “Are we backing up our data?” It should be, “Could we recover our critical systems if we needed to?”

5. Keep security awareness active

Cyber security awareness training should not be a once-a-year exercise. Regular training helps employees recognise phishing emails, suspicious links, unexpected authentication requests and other social engineering techniques designed to trick users.

Just as importantly, make suspicious activity easy to report. Employees who click a suspicious link or respond to a phishing scam should know exactly who to contact.

Fast reporting supports early detection and gives security teams more opportunity to contain security incidents before they escalate.

The aim is to make good security awareness and reporting behaviours second nature, not something employees revisit only during Cyber Security Awareness Month.

6. Look for unusual activity

Cyber attacks are easier to contain when suspicious activity is identified early. Use appropriate monitoring, endpoint security, firewalls and intrusion detection systems to identify unusual activity such as unexpected logins, privilege changes, large data transfers or disabled security tools.

Technology cannot identify everything. Employees may notice strange behaviour or suspicious emails before automated controls do, which makes reporting an important part of detection too.

Regularly review internet-facing systems as well. Forgotten domains, remote access services and unpatched applications can expose organisations to common cyber security threats and increase the risk of unauthorised access and data breaches.

7. Practise your incident response plan

An incident response plan only becomes useful when people know how to follow it. Run short exercises covering realistic scenarios such as ransomware attacks, stolen credentials or a potential data breach. Establish who declares the incident, isolates systems, preserves evidence, investigates suspicious activity and communicates with customers.

Ensure cyber security roles and decision-making responsibilities are clear before an incident occurs, including what happens if email or Microsoft Teams becomes unavailable.

Practising incident response exposes gaps while there is still time to fix them, helping protect important data, accelerate recovery and maintain customer trust when a genuine incident occurs.

Make good cyber security habits routine

Cyber security does not become strong because an organisation completes a checklist once. People join and leave. Systems change. New cloud services are introduced. Cyber threats evolve. Software reaches end of life and controls that worked six months ago may no longer reflect the organisation’s environment.

Good cyber security best practices consequently rely on repetition. Rather than treating every review as a major programme, give each habit a clear owner and measurable outcome. This month, that could mean reviewing administrator access, enforcing multi factor authentication on high-risk accounts, identifying unpatched systems, restoring a backup and running a 30-minute incident response exercise.

Next month, repeat the process and address what changed.

These security measures will not make cyber attacks impossible. No organisation can remove every risk. But consistent access control, strong passwords, regular backups, employee training, patching, monitoring and incident response can significantly reduce avoidable weaknesses and improve cyber resilience.

Most importantly, they help turn cyber security from an occasional project into part of how the organisation operates.

For businesses looking to understand weaknesses in their current security posture, strengthen incident readiness or improve recovery capabilities, Zensec can help organisations assess cyber risk and build more effective cyber resilience.