Cybersecurity is a massive industry, generating between $212 billion and $302 billion per year—and for good reason. For every moment of every day, cybercriminals are working tirelessly to bypass our defenses and gain access to our data, money, software, accounts, and more. To call attention to this ever-increasing plague, each October, we celebrate National Cybersecurity Awareness Month, an event dedicated to building on the overall knowledge, awareness, and cybersafety of Americans and businesses.

National Cybersecurity Awareness Month was originally started in 2004 as a joint effort between the Department of Homeland Security and the National Cybersecurity Alliance. At the time, the internet was still in its early years, with the World Wide Web only having been introduced to the public in the mid 1990s, but it had taken off in the early 2000s, and with it, the start of cybersecurity attacks.

While the intention and ultimate goal of the month remain the same over time, each year highlights a different theme for participants to focus on. According to the founders of the event, this year’s theme is: Don’t Make It Easy for Them. “Staying safe online isn’t about making one perfect decision,” says the National Cybersecurity Alliance. “It’s about building habits and repeating them consistently in the small moments that happen every day. In doing this, we can all make life difficult for cybercriminals.”

The cybersecurity threat

Now entering its 22nd year, the need for cybersecurity awareness is more critical than ever.

In an average week in 2026, an organization will face 2,336 cyberattack attempts or roughly 334 per day. The average individual, according to a worldwide poll from Talker Research, found that the average American navigates an average of nine calls, nine emails, and another seven text messages every single week, or about 100 scam encounters per month.

However, that same poll revealed that only 23% of those respondents are “very confident” in their ability to determine if something is legitimate or a scam. The takeaway? Consumers and businesses are constantly bombarded with cyberthreats and bad actors, but are struggling more and more to differentiate fact from fiction, particularly with the introduction of artificial intelligence.

AI has its hands in just about everything these days, and you can bet it’s playing both offense and defense in the world of cyberattacks. In fact, according to CrowdStrike’s 2026 Global Threat Report, in 2025, “AI-enabled adversaries increased attacks by 89% year-over-year.” AI is the future of cyberattacks, but it can also be the future of our defense—but more on that later.

Overall, attacks are increasing, while our time to respond to these incidents is decreasing. With that in mind, what can your credit union do to beef up your cybersecurity methods and training this October?

Run through the basics

Never underestimate the power of the basics. We often write these off as simple or common sense, but more often than not, it’s the simplest ways past our defenses—a phishing email, a brute-force attack, malware in a link, etc.—that cybercriminals exploit the most. These attacks rely on human error or poor digital habits to sneak their way into our systems, and all it takes is one employee slipping up and clicking on something they shouldn’t to open the door and let them in.

Not to worry, though, there are some great and easy ways to help prevent these snakes from getting into the garden. First, make sure you and your staff are practicing strong digital habits—using strong passwords and changing them on a regular basis, enabling multifactor authentication when required, keeping software updated, and backing up critical files.

Next, keep your staff relentlessly informed on when, where, and how these attempts might occur. Make sure they’re familiar with what a phishing attack looks like versus a genuine email. If the “CEO” is emailing them, do they know to confirm the sender’s email? Do they know to check if the email was sent from outside the organization? Make sure they do, and then send fake phishing emails throughout the year to test that knowledge.

It’s also a good idea to go over the credit union’s business continuity plan and what role each employee plays in that plan. If someone does click on a link, what’s the next step? Who should they inform? What actions do they take to minimize the damage? Consider doing a tabletop test and trying out a few different scenarios until everyone feels confident that they know what to do in the event of a cybersecurity incident. A quick response to a cyber threat is just as important as keeping it from happening in the first place.

Investigate new technologies and partners

The basics are great, but flashy new tools and technology have their uses too. The cybercriminals are using every tool at their disposal, and so should your credit union. Use this month as an opportunity to investigate new technologies, vendors, and methods for keeping your credit union secure. What might have been the perfect defense five years ago may be well behind the times nowadays, with how quickly the industry moves and evolves.

I mentioned earlier how artificial intelligence has become a cybercriminal’s preferred weapon in the last few years, but it can also be your shield. If you haven’t started looking into how AI can support or strengthen your cybersecurity efforts, now is the time! (Oh, and while we’re on the topic of vendors and partners, make sure you’re aware of their cybersecurity plans too. If they’re vulnerable, so are you.)

Don’t leave your members out!

Fortifying internal cybersecurity education and training is great, but don’t forget that members play a critical role in the valiant effort to keep your credit union as cybersecure as possible and should not be overlooked. Marketing and external communication efforts should focus on robust member education, covering both the basics (good digital hygiene, password safety, standard methods cybercriminals exploit and how to identify them, etc.) as well as new and emerging tactics bad actors are utilizing that your members may not be up to date on.

Scammers are constantly evolving their tactics and tools, and so we must constantly update members’ awareness of them. In the hands of cybercriminals, AI is working to make romance scams, imposter scams, and phishing more believable than ever. Bad actors can now send convincing photos, videos, texts, and documents to their target that are nearly indistinguishable from the real thing.

Educate your members on these new developments and remind them how, when, and why the credit union will contact them. How can members spot the difference between real credit union communications and AI? What information will the credit union ask for and what will it never ask for in a text? Do you include links in your messages or is that a giveaway that a member is being scammed? What should they do if they’re not sure?

In the cybersecurity war, member education efforts are our soldiers at the front, so if you’re not already actively working on this, now is the time!

Stay cybersecure in October and beyond

Your credit union shouldn’t be waiting for October to inform members about evolving cybersecurity threats, nor to do these cybersecurity checks, but it’s also the perfect time to do so if you haven’t yet. If you’re looking for advice or ways to get started, you can check out our articles on the topic, and stay tuned, as we will be tackling the subject of cybersecurity all throughout October!

And remember, don’t make it easy for them!