October is Cyber Security Awareness Month. This is the final article in a series throughout October that will call attention to the importance of cyber security awareness.
An attacker calls the help desk and talks a representative into resetting an account. An unpatched server opens the path deeper into the network. Shared administrative credentials put the backups in reach. Recovery runs long because nobody had tested what a restore actually depends on. Meanwhile, a reporting deadline is already running.
Five problems. Four articles. One incident.
Written policies, completed scans and successful backup jobs show important activities are happening. By themselves, they do not demonstrate whether the business can withstand an incident and recover. That requires testing how the pieces work together.
This recap brings October’s four articles together, including all 16 questions for leadership.
The first article looked at attacks arriving by phone, text, collaboration platforms and the help desk. The 2026 Verizon Data Breach Investigations Report attributed 41% of social engineering breaches to a channel other than email. A convincing request can travel through familiar tools and ordinary procedures without looking like phishing.
AI can reduce the time and cost of researching a target and developing a convincing story. Smaller organizations should expect personalized approaches, even if they once considered themselves unlikely targets.
Verification has to hold when the caller sounds credible and is in a hurry. Payment changes, credential resets and access requests need a check the requester does not control. Team members also need a fast, blame-free way to report suspected deception.
1. Do we have a written out-of-band verification requirement for payment changes, credential resets and access requests, and does it apply regardless of who is asking or how urgent it sounds?
2. What does our help desk require before resetting a password or MFA enrollment, and who is permitted to waive it?
3. Does our awareness testing include voice, text and collaboration platforms, or only email?
4. If an employee realized an hour from now that they had been deceived, would they know who to call, and would they make the call?
Read the full article: Phishing Moved to Teams, Text and the Help Desk: The New Shape of Social Engineering
Verizon reported a median remediation time of 43 days. Separately, Mandiant found the median interval between initial access and hand-off to another threat group was just 22 seconds in its 2025 investigations. These measure different stages, but illustrate the pressure on defenders.
In Verizon’s observed 2025 data, only 26% of critical vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog were fully remediated.
Technical severity alone cannot set urgency. A moderate weakness on an internet-facing system under active exploitation may warrant action today; a higher-scoring finding on a well-isolated internal application may wait.
A current system inventory helps identify exposure, including unsupported systems. When a patch must wait, record the risk, interim protection, owner and review date. A shrinking backlog is good news only if the risk shrank with it.
5. Do we prioritize known exploited vulnerabilities and internet-facing systems, rather than relying on severity scores alone?
6. Which critical vulnerabilities sit outside our remediation targets, and what reduces the risk while they remain unresolved?
7. Do unsupported systems have a funded replacement or support plan?
8. Are exceptions formally approved, periodically reviewed and eventually retired?
Read the full article: Why the Shrinking Patch Window Makes Vulnerability Management a Business Risk Decision
Verizon’s 2026 report found ransomware in 48% of breaches, and 69% of ransomware victims did not pay. Avoiding a ransom payment does not mean avoiding serious losses. Restoring systems does not undo data theft.
Restoring data accomplishes little if team members cannot authenticate, applications cannot reconnect, or a critical provider is down. Attackers also target backup infrastructure and the accounts used to administer it.
Protect recovery copies and access to them. Map dependencies before an incident. Test a complete business process instead of a single file restore. Recovery objectives should reflect demonstrated performance. Business leadership should set acceptable downtime and restoration priorities with IT’s input.
9. Are critical backups immutable, and is their authentication protected separately from production?
10. When did we last restore a critical system and verify the business could actually use it?
11. Do recovery objectives reflect demonstrated testing results or hoped-for performance?
12. Which processes have a manual fallback, and how long can we operate that way?
Read the full article: Beyond Backups, Is Your Business Ready for Ransomware Recovery
Reporting obligations have different triggers. HIPAA runs from discovery of a breach, Colorado from determination of a security breach, and the SEC from a materiality determination. For covered Nevada gaming entities, a qualifying incident can start the notification clock when response procedures are activated, while investigators are still establishing its scope.
Identify applicable obligations with counsel before an incident. Assign decision authority, preserve evidence and track deadlines together. Vendor reporting terms must support your own. Assume the investigation will still be open when the first decision comes due.
13. Which reporting requirements are most likely to apply, and who determines whether a threshold has been crossed?
14. Do we retain enough evidence to investigate events beginning weeks or months before discovery?
15. Do critical vendors have reporting obligations supporting our own deadlines?
16. Have we practiced a deadline arriving before the investigation is complete?
Read the full article: Is Your Organization Ready for Cyber Incident Reporting and Breach Notification
Identity verification protects access to production and recovery systems. A system inventory supports both remediation and restoration priorities. Logs help establish what happened and inform notification decisions. During an incident, these become shared business concerns.
Bring IT, security, finance, operations and legal together to work through the questions. For each answer, identify the evidence, owner and action. Treat “we do not know” and “we have not tested it” as findings.
Then run one scenario across all four topics, from the first access decision through reporting as facts change. Record where assumptions break and set dates to fix them.
Leadership should be able to explain what the organization has proven it can restore and how it would make decisions with incomplete information.
RubinBrown’s Cyber Security Services team helps organizations evaluate these capabilities and connect technical findings to business priorities. Learn more at rubinbrown.com/cyber.
RubinBrown’s Cyber Security Services and Technology Consulting teams can help identify affected systems, confirm updates with your providers and investigate suspected compromise. Learn more about RubinBrown Cyber Security Services.
Published: 10/26/2026
Readers should not act upon information presented without individual professional consultation.
Any federal tax advice contained in this communication (including any attachments): (i) is intended for your use only; (ii) is based on the accuracy and completeness of the facts you have provided us; and (iii) may not be relied upon to avoid penalties.