Cybersecurity Doesn't Have to Be Complicated: 4 Habits That Make You Harder to Target
Updated: Oct 13
Cybersecurity advice can get complicated quickly.
Use this tool. Change that setting. Watch for this attack.
For someone who does not work in cybersecurity every day, it can start to feel like staying safe online requires becoming a security expert.
It doesn’t.
Some of the most useful cybersecurity practices are also some of the simplest. They work because they create extra barriers between a criminal and the person, account, or information they are trying to reach.
Cybersecurity incidents are rarely just technical events; they can be also human-based. A scam can mean lost savings. A compromised account can affect someone’s identity or financial security. And being deceived can leave a person questioning their own judgment long after the incident is over.
Protecting people means helping them feel prepared—not overwhelmed, frightened, or ashamed.
That is why I keep coming back to a simple progression:
We need to recognize risk, but we also need habits that help us know what to do when that risk shows up.
Here are four places to start:
1. Pause before you act.
2. Stop giving multiple accounts the same password.
3. Turn on multi-factor authentication.
4. Let your devices update.
Let's touch on each of these.
Pause before you act
Many suspicious messages have one thing in common; they want you to do something now:
Your account is about to be closed.
Your package cannot be delivered.
Your boss needs gift cards immediately.
A family member is in trouble.
Someone has detected suspicious activity on your bank account.
The circumstances change, but the pressure serves a purpose. When we feel rushed, worried, excited, or distracted, we are less likely to question what is happening.
One of the simplest security habits is also one of the most powerful:
Create a pause between the request and your response.
Before clicking a link, sending money, providing information, or approving an unexpected request, stop and ask yourself:
Was I expecting this?
Is this person asking me to act unusually quickly?
Can I verify the request another way?
That last step is especially important. If your bank supposedly calls you, for example, you can hang up and call the number on your card or the bank's official website to verify the request being made from you.
Why it works:
There is research behind the value of slowing down. In a 2025 study of 2,673 participants, researchers found that tasks designed to slow users down and focus their attention on a URL significantly reduced successful phishing attempts. USENIX
You do not have to analyze every message like a forensic investigator; all you simply need is enough time to pause, question, and verify.
The habit: When someone else is trying to speed you up, deliberately slow yourself down.
Stop giving multiple accounts the same password
The act of reusing passwords is understandable. It's easier to remember when you use the same 2 to 3 passwords across all of your accounts. There are far more online accounts that we need to access than we could possibly remember. Creating a completely different password for every account is not difficult. Remembering them all is a different task altogether, however.
But did you know that reused passwords actually create an MORE security problems?
Think about it...If one account becomes compromised, the same username and password combination can potentially be tried somewhere else. This is a common tactic among hackers. What began as one exposed credential has now expanded the problem exponentially.
The better approach is to use a different password for every important account you have and let a reputable password manager help you keep track of all of them. This can reduce your reliance on using easy-to-guess or reused passwords.
Keeping track of them in a password manager is not as time consuming as you would think. Start with the accounts that could cause the most damage if someone gained access:
Your primary email account.
Your financial accounts.
Your social media accounts.
Your cloud storage.
The most important out of all of these is your email account because it is often connected to password resets for many of your other accounts. Once a hacker can access your email account, they can use it to change passwords on your other accounts.
The habit: One account, one unique password—and let technology do the remembering.
Some good free or low-cost password manager options include:
Turn on multi-factor authentication
A password asks someone to prove what they know, but multi-factor authentication (MFA or 2FA) adds another form of proof that you are who you say you are. It creates another hurdle for a criminal trying to access your account with a stolen password. MFA is accomplished through an authentication app on your cell phone, security key, passkey, biometric verification, or a one-time code.
Recent research provides a useful real-world example of the importance of MFA. A 2026 experiment studied three major Canadian banks as they implemented two-factor authentication. The researchers found that a bank policy of mandatory MFA significantly reduced the number of compromised accounts, while an optional MFA policy produced an increased number of compromised accounts. Sage Journals
Turn MFA on wherever it is offered, particularly for email, financial, social media, shopping, and cloud accounts. When stronger options such as passkeys, authenticator apps, or security keys are available, consider using them.
And remember that MFA introduces another behavior worth practicing:
Never approve an authentication request you did not initiate.
If you receive an unexpected MFA notification, don't disregard it! It's a warning sign that someone else is trying to access your account.
The habit: Turn it on MFA wherever it is offered or available for you to use and pay attention when it speaks up.
Let your devices update
It's a common scenario for all of us:
You are working on, or are in the middle of doing something on your computer it suddenly wants to restart to install an update.
So we click: Remind me later.
And sometimes we keep clicking it! It’s NEVER the right time to take yourself away from whatever you’re working on to start up that update.
Remember, software updates are not only about adding new features to your device. They can also correct security vulnerabilities that attackers may be able to exploit.
Turn on automatic updates wherever possible for your computer and phone operating systems, web browsers, applications, security software, and other internet-connected devices.
Then give your devices the occasional restart they need to finish installing them. You do not need to understand the vulnerability being fixed. You just need to close the door it might have left open.
The habit: If an update can safely happen automatically, let it.
Security works better when it works in real life
None of these four habits makes someone impossible to target. That's unrealistic given how clever cybercriminals are.
Cybercriminals adapt. Technology changes. And even people who understand cybersecurity can make mistakes when they are tired, distracted, stressed, or caught off guard (***raising my hand***).
The goal is to make successful attacks harder:
A unique password means a stolen credential may not unlock another account.
MFA adds another barrier.
Updates remove known vulnerabilities.
And pausing before responding can interrupt the emotional pressure that makes many scams effective.
Each habit creates a little more friction for the attacker—and a little more protection for the person.
That is the kind of cybersecurity awareness I want to see more of.
Good cybersecurity education should help people feel more capable of protecting themselves.
Awareness tells us a risk exists and preparedness helps us know what to do. When those two actions become habits, safer behavior becomes much easier.
That is where cybersecurity awareness starts making a real difference.
A simple place to start
This week, choose one important account—your primary email account is a good candidate—and ask yourself four questions:
Do I use a unique password?
Is MFA turned on?
Are my devices set to update automatically?
Would I know how to independently verify an unexpected request involving this account?
You don't have to fix everything in one afternoon.
Start with one account. Then another.
Small habits, repeated consistently, can build a much stronger layer of protection around the things—and the people—that matter.
Selected research
Lain, D., Nakatsuka, Y., Kostiainen, K., Tsudik, G., & Capkun, S. (2025). URL Inspection Tasks: Helping Users Detect Phishing Links in Emails. 34th USENIX Security Symposium, 1435–1454. Their study of 2,673 participants provides particularly useful evidence for your “pause” concept. USENIX
Kamar, E., Howell, C. J., Maimon, D., & Fraser, I. (2026). Evaluating the Effectiveness of Two-Factor Authentication (2FA) in Mitigating Account Takeover Fraud: A Natural Experimental Study on Canadian Banks. Crime & Delinquency. doi:10.1177/00111287261441235. Sage Journals
Comments