As Cybersecurity Awareness Month draws to a close, KICTANet’s Tatua Digital Resilience Centre has spent October reminding individuals and organisations that online safety begins with everyday behaviour. This year’s theme, “Don’t Make It Easy for Them,” is a practical call to action: attackers often succeed not because their tools are sophisticated, but because people are rushed, distracted, or using predictable habits.
For Tatua, which supports social justice organisations across Kenya, Tanzania, and Uganda, the campaign is especially important. Civil society groups handle sensitive information about the communities they serve, often with limited security resources. Digital resilience is therefore not only a technical issue; it is part of protecting people, privacy, and the ability to continue important work.
The existing knowledge-doing gap.
Most people already know the basics. They know they should not reuse passwords, click unexpected links, ignore software updates, or share verification codes. Yet knowing is not the same as doing. Under deadline pressure, convenience often wins: one memorable password feels easier, a suspicious message looks urgent, and an update can always wait until tomorrow.
This is the knowing-doing gap. Awareness campaigns are valuable, but they only create lasting change when secure actions become easy and routine. A password manager removes the burden of remembering dozens of passwords. Multi-factor authentication (MFA) adds a second barrier, even if a password is stolen. Automatic updates close known vulnerabilities before attackers can exploit them.
Tatua’s campaign has focused on four habits: strong passwords, MFA, software updates, and phishing awareness. These actions are simple, but their real power lies in consistency. Security is less about occasional dramatic action and more about small decisions repeated every day.
How AI is changing the equation
Artificial intelligence is changing the threat landscape by making scams more convincing and easier to produce. Attackers can now create polished emails, impersonate organisations, imitate voices, and tailor messages using publicly available information. The old advice to spot poor grammar is no longer sufficient.
The response is not fear; it is verification. When a message creates urgency especially one involving money, account access, or a request from a senior colleague pause before acting. Contact the sender through a known phone number or official channel. Do not trust contact details included in the suspicious message itself.
Tatua’s phishing guidance warns against urgent or threatening language, such as claims that an account will be blocked, and advises users not to click links, download attachments, or respond before verification. In an AI-driven environment, taking an extra minute to verify can prevent a serious loss.
Cybercrime isn’t hypothetical anymore for many of us.
Cybercrime has moved from abstract news stories into everyday life. People encounter it through fake mobile-money alerts, impersonation scams, fraudulent investment offers, compromised email accounts, and malicious links shared on WhatsApp or other messaging platforms.
For organisations, a single compromised account can expose beneficiary data, donor records, financial systems, and internal communications. For individuals, the consequences can include financial loss, identity theft, harassment, and lasting emotional distress. Many victims feel embarrassed, which makes early reporting even more important.
Tatua’s support model recognises this reality. Its helpdesk provides preventive support, such as security audits and risk assessments, as well as incident response for at-risk civil society communities. The goal is to make it normal to ask for help before a small problem becomes a crisis.
Training is a good defence.
Technology matters, but people remain the first line of defence. No firewall can prevent someone from approving a fraudulent payment after a convincing phone call, and encryption cannot protect credentials willingly handed to a scammer. Practical, repeated training is therefore essential.
Effective training does not shame people for making mistakes. It uses realistic scenarios, explains pressure tactics, and gives staff clear steps for verifying requests and reporting concerns. It should reflect local realities, including M-Pesa-related scams, WhatsApp impersonation, fake job offers, and urgent messages claiming to come from management.
Throughout the month, KICTANet and Tatua have combined practical tips, resources, and an interactive webinar to help people discuss real risks and ask questions. This approach shifts cybersecurity from a technical subject to a shared organisational responsibility.
Turning awareness into easy habits
As the month ends, the challenge is to carry these lessons beyond October. Organisations and individuals can start with a few achievable actions:
- Use a password manager and create unique, long passwords for every account; Tatua recommends at least 16 characters
- Enable MFA on email, WhatsApp accounts, financial platforms, cloud storage, and administrative accounts.
- Turn on automatic updates for phones, computers, browsers, and applications.
- Verify unexpected requests through a separate trusted channel before clicking, paying, or sharing information.
- Report suspicious messages promptly to IT, a security focal point, or the relevant platform.
- Back up important data and periodically test whether the backups can be restored.
- Make cybersecurity part of onboarding, staff meetings, and organisational policy.
Cybersecurity is ultimately about protecting people and the digital spaces where they live, work, and organise. “Don’t Make It Easy for Them” reminds us that attackers rely on haste, habit, and hesitation. By making secure behaviour easier and suspicious behaviour easier to question, we can turn a month of awareness into a lasting culture of digital resilience.
