October has again filled social media with cybersecurity advice. On X, professionals, educators and technology organisations are running 30-day challenges, sharing password-manager tips, explaining multi-factor authentication and reminding people to install software updates. The advice is useful. Strong passwords, MFA, scam awareness and timely patching still prevent real harm.
But Cybersecurity Awareness Month now risks teaching yesterday’s threat model to people living in today’s attack environment. The old message assumed criminals mainly wanted a password or a careless click. Increasingly, attackers exploit trusted identities, authenticated sessions, cloud services, collaboration tools and legitimate security workflows. Awareness must therefore evolve from protecting credentials to verifying trust before, during and after authentication.
The evidence is difficult to ignore. Microsoft’s 2026 Digital Defense Report says it detected more than 145 million QR-code phishing attacks between July 2025 and June 2026 and more than 46 million business-contact impersonation attacks over the previous 12 months. It also found that 93 per cent of voice-phishing attacks kept victims engaged long enough for social engineering to begin. The Anti-Phishing Working Group separately reported that phishing attacks rose 10.1 per cent in the second quarter of 2026, while SMS phishing increased 40 per cent.
Attackers are also learning to weaponise authentication itself. CrowdStrike reports that pishing intrusions doubled in the first half of 2026 and monthly device-code phishing attempts increased fifteen-fold. Palo Alto Networks’ Unit 42 found identity weaknesses played a material role in almost 90 per cent of its investigated incidents, with identity-based techniques accounting for 65 per cent of initial access. The modern attacker often does not need to “break in” if a victim can be persuaded to approve, authenticate or surrender an already trusted session.
This does not mean the familiar advice is wrong. MFA remains one of the most effective security controls available. The problem is treating every form of MFA as the destination. SMS codes, voice calls, one-time passwords and approval prompts can still be phished, intercepted or manipulated. NIST now explicitly recommends phishing-resistant authenticators for higher-assurance use, while Microsoft has begun making passkeys the default authentication experience in Entra ID and plans to retire its own SMS and voice authentication delivery in 2027.
Passkeys point in the right direction because FIDO2 and WebAuthn bind cryptographic credentials to the legitimate service rather than asking users to type reusable secrets into websites. FIDO Alliance research published this year estimates that five billion passkeys are already in use worldwide and that 75 per cent of surveyed consumers have enabled one on at least one account.
Yet even better technology cannot rescue poor implementation. A Distinguished Paper at USENIX Security 2026 examined 872 passkey-enabled websites and security-tested 103 of them. Researchers found two critical attack types on 18 sites and at least one high-severity weakness on 53. Separate SOUPS 2026 research found substantial inconsistencies in how 111 websites implemented passkey user experiences. The lesson is not that passkeys fail, but that secure standards still require secure engineering, usable recovery and disciplined deployment.
Human behaviour also remains central, but awareness programmes must become more realistic about how people are manipulated. A USENIX Security 2026 experiment involving 7,700 participants found that personalised phishing generated with large language models almost tripled click rates compared with generic phishing, at an estimated cost of only about three US cents per message.
Other 2026 usable-security research shows that people can hesitate even after recognising suspicious messages because they fear ignoring a legitimate workplace request. Attackers exploit urgency, authority and uncertainty, not simply ignorance.
Kenya has particular reason to modernise its awareness model. The Communications Authority’s National KE-CIRT/CC detected about 2.36 billion cyber-threat events between April and June 2026. Across the full 2025/26 financial year, detections reached 11.12 billion, up 29 per cent year on year, while web-application attacks nearly doubled.
These are detected threat events, not successful breaches, but they show the pressure surrounding an economy increasingly dependent on mobile money, cloud services, digital government and online commerce. GSMA estimates that mobile technologies contributed $240 billion to Africa’s economy in 2025, showing why digital trust is now economic infrastructure.
What Kenya needs next is Cyber Hygiene 2.0. The first generation taught strong passwords, password managers, MFA, phishing awareness and software updates. The next must add phishing-resistant authentication, secure account recovery, session protection, scrutiny of QR codes, independent verification of unusual requests and safeguards against voice, video and message impersonation.
Organisations must carry more of this burden. Awareness should never become a convenient way to blame an employee after badly designed systems fail. Banks, government agencies, employers and technology providers should adopt safer defaults, least-privilege access, secure recovery processes, stronger session controls and verification for high-risk transactions. OWASP guidance supports precisely this broader approach by treating MFA-factor changes, recovery and authenticated sessions themselves as security-sensitive processes.
Cybersecurity Awareness Month should still teach people not to reuse passwords. But its bigger task now is teaching citizens and institutions how modern trust is abused. Passwords were the first battlefield. Identity is now the perimeter, and awareness must catch up.
George Kariuki
ICT, Cybersecurity and Digital Governance Professional
0721912978
[email protected]
