10/08/2026
97% of identity attacks in the first half of 2025 were password attacks, per the Microsoft Digital Defense Report. Phishing-resistant authentication blocks over 99% of them. Yet we're a week into Cybersecurity Awareness Month, and most campaigns are already spending it on posters nobody measures.
It's not too late to run a different one. Four weeks, four behaviors, starting this week and running into early November. For each one, an adoption metric plus an outcome metric an attacker would actually feel.
Week one: phishing-resistant MFA. Not "turn on MFA," which you've nominally done. A passkey and Windows Hello for Business registration drive, with Entra registration campaigns nudging at sign-in. Measure the percentage of users with a phishing-resistant method registered.
Week two: updates. Let Intune do the enforcement through update rings and compliance policies, with Conditional Access acting on non-compliant devices. Measure median days-to-patch, trending down.
Week three: reporting. The framing is generous: we don't need you to be a detection engine, just pull the alarm. Verify Report Message is one click on every surface. Measure report rate, then time-to-triage, which Defender plus the Phishing Triage Agent should hold under ten minutes.
Week four: backups. Push OneDrive Known Folder Move for individuals, and for the org, restore one tier-one system end to end with a stopwatch and publish the time. 96% of ransomware attacks target backups, per Veeam. An untested backup is a theory.
Then keep the eight-metric dashboard alive after the campaign wraps. Four weeks is the push. The dashboard is the accountability.
Quick wins this week:
Baseline all eight metrics
Recruit business leaders, not security, to deliver the weekly messages
Schedule the timed restore drill now
What's the one behavior you'd add as week five?
https://hubs.ly/Q04zzMZ50
