This year’s Cybersecurity Awareness Month recommendations from CISA kept to the fundamentals: avoid and report phishing, use strong passwords, turn on multi-factor authentication (MFA) with a password manager, and keep software updated. The campaign toolkit also recommends phishing-resistant MFA where it’s available.
Those basics stop a great deal of everyday attacks, and every business should have them in place. But as a recent Security Magazine analysis points out, they are a starting point rather than a finish line.
Attackers go around MFA
The article argues that attackers increasingly target the processes around MFA instead of breaking it: the help desk, account recovery, or the step where a new authentication method is enrolled. It cites a September 9 Microsoft investigation describing intrusions with unusual sign-ins and attacker-added authentication methods, without any break in the underlying cryptography.
Building on the basics
- Prefer phishing-resistant MFA, such as passkeys or security keys, for email, finance and admin accounts.
- Verify identity before password resets or new MFA devices. Your help desk should never reset access on a phone call alone.
- Review alerts for new sign-in methods and unusual logins, not just failed ones.
- Limit administrative access so one stolen account can’t reach everything.
Not sure whether your MFA setup would hold up? We’re happy to review it with you. Call (317) 585-6100.
Source: Security Magazine, “The Problem with CISA’s 2026 Cybersecurity Awareness Month Recommendations” (October 2026).