Don’t Waste October

October is three months away. Which means somewhere, right now, someone is beginning to half-consciously form a plan for Cyber Security Awareness Month… and it already looks a lot like last year’s. And if nothing interrupts that decision it will land where it always lands. Posters in the lift with a padlock on them. A themed email from the security team. A phishing simulation that catches the same people it caught last year. An LMS module assigned to the whole company with a completion deadline at the end of the month. A great deal of activity, dutifully logged, changing almost nothing. The same October it was last year… and the year before that… and the year before that…

IT DOESN’T HAVE TO BE LIKE THIS! But avoiding it requires starting now, because the difference between a month that matters and a month that evaporates is almost entirely in the planning, and good planning cannot be done in September.

So this is what is worth deciding early. What is October actually for?! If the honest answer is that it is for demonstrating to an auditor or a regulator that awareness activity took place, then fine…. run the posters and the module and do not pretend it is anything more, because dressing compliance up as culture fools nobody and exhausts everyone. But if the answer is that October is meant to genuinely move how people behave… then the plan has to look completely different, and it has to be built on what actually changes behaviour rather than what is easiest to organise.

We’ve spent years telling people what that is. Behaviour does not change because people are told things. It changes when they experience something, when the experience is shared across a team and creates a common language, when the environment around them stops punishing the right action and starts making it normal, and when all of that is repeated often enough that the right response stops requiring conscious thought. You can’t create awareness without engagement first. Culture determines whether either of them sticks. Instinctive behaviour is what falls out of the other end.

A real October plan uses the month as a spark, not the whole fire. It builds an experience people actually talk about afterwards, the kind that becomes a story retold at desks for weeks, because a story is remembered and a slide is not. It connects that moment to the months on either side of it, so the spike does not flatline by November. It measures the right things, behaviour under pressure rather than boxes ticked. And it treats the learning team and the security team as partners in the design rather than one commissioning and the other hosting. None of that has to be massively more expensive than the usual approach. The organisations getting this right are not spending more. They are spending differently. On rehearsal instead of reminders. On experience instead of content.

The reason to begin in July rather than September is simply that the good version takes time to build and the bad version does not. The posters can be ordered in a fortnight. An experience that genuinely shifts how a thousand people behave cannot. So the choice you make about October is really a choice you are making right now, in the middle of summer, before the calendar forces your hand.

Make it the year October meant something. Decide now, while there is still time to build something worth the month.