Monday 26 October 2026 | A 4-minute read
Hello Champions! This week's stories all circle one idea: most people want to do the right thing, and their behaviour is decided by whichever path is easiest. Scammers know it, which is why they keep finding the doors nobody guards. The good news is that we can use it too, by making the safe choice the simple one. Five stories, each with something small you can run with.
1. Training works when people actually get it
A big yearly survey called Oh, Behave! (run by the National Cybersecurity Alliance, a non-profit, together with a security company called CybSafe) asked 5,000 people across five countries about their security habits. Two findings stand out. Almost 9 in 10 people who received security training found it useful, and about half of them got better at spotting scam emails afterwards. But fewer than half of working people are given any required security training at all. The survey also found 8 in 10 people now use AI tools, while more than half of them have never been told how to use those tools safely, and about a third of people using AI at work have pasted in company information they probably shouldn't have.
Evidence you can use: If you're making the case for more training time or a session on using AI safely, quote this: almost 9 in 10 people who get security training say it's useful, yet fewer than half of workers are offered any. You're not pushing something unpopular. People actually want this.
2. We're more confident than careful
The European Commission (the EU's civil service) surveyed workers across Europe about security at work. Three out of four said they come across suspicious emails, messages or links on the job. Here's the gap worth noticing: about 7 in 10 workers feel confident they could spot a fake email, but only just over half actually check who sent a message before clicking a link in it. Feeling able and doing the check are very different things.
Try this activity: Run a one-week "who sent this?" challenge with your team. The habit takes ten seconds: before clicking any link in a message, glance at the sender's actual address, not just the display name. Ask everyone to try it for a week and share the oddest thing they spot. One person's catch makes the whole team look twice.
3. When security slows the work, people route around it
Researchers asked 700 IT leaders in four countries about staff who work away from desks, in places like hospitals and factories. Almost every organisation had seen people working around security in the past year: staying permanently signed in, sharing logins, or dodging two-step login (that extra code or tap that confirms it's really you). The most common reason was wonderfully human: try typing a password while wearing protective gloves. When logging in is a struggle, people find a shortcut so they can do their jobs.
Talking point: Ask your team, "Where does security genuinely slow you down?" and collect the answers without judgement. Then pass them to your security team. Workarounds aren't laziness; they map where the tools don't fit the work, and the people who designed them usually have no idea. You can be the messenger.
4. Watch out for meeting invites you weren't expecting
Scammers have found a sneaky new route: fake calendar invites. Two security research teams tracked these attacks growing from a few thousand a month in the spring to more than 740,000 in just the first two weeks of October. Why invites? A fake meeting lands in your inbox and on your calendar at the same time, and it can stay sitting on your calendar even after the dodgy email behind it has been removed. And a meeting you don't remember booking is hard to ignore, because ignoring real meetings gets you in trouble.
Try this activity: Post a short heads-up in your team channel. Something like: "Scammers are now sending fake meeting invites. If an invite appears from someone you don't know, don't click its links; just report it like you would a suspicious email." One message, thirty seconds, and your whole team now knows about a trick most people have never heard of.
5. No real website asks you to copy and paste a "fix"
A scam is going around where a web page shows a fake error and tells you to fix it by copying text and pasting it into a window on your computer. That pasted text is actually a command that hands your machine to the scammers. Google has taught Chrome to spot this trick and warn you in the moment if you have its "Enhanced Protection" setting on.
Talking point: Share this one line with your team and your family: no genuine website will ever ask you to copy and paste a command into your computer to fix a problem. If a page does, close it. Almost nobody has been told this rule, and once you hear it, it's hard to fall for.
That's it for this week. None of these takes more than a few minutes, and that's rather the point. A heads-up message here, a ten-second habit there, and the water keeps moving long after you've thrown the stone. Have a great week!