In October, organisations are busy with vibrant posters, hosting webinars, sharing security tips, organising conferences and reminding us to be cautious online. The messages are familiar: Think before you click. Guard your password. Watch out for fraudsters. Keep your PIN private. Stay safe online.
But what happens when October ends?
In the hidden corners of the internet, cybercriminals might be quietly watching our awareness efforts, waiting for the banners to come down before they resume their activities. Unfortunately, these criminals do not follow our corporate schedules. They do not take breaks for public holidays, budget cycles or the end of a successful awareness campaign. Unlike some of our organisational efforts, their operations do not need fresh approval each financial year.
To be fair, Uganda has made significant progress in promoting cybersecurity awareness. Government bodies, financial institutions, telecom companies and professional organisations continue to invest in public education and digital safety. These efforts deserve recognition, especially as mobile money, digital banking, online government services and social media become more ingrained in daily life. However, the visibility of awareness campaigns does not necessarily mean better cybersecurity.
An organisation might hold several webinars, distribute numerous posters, achieve full staff participation and still have employees using weak passwords, sharing credentials or approving suspicious transactions without proper verification.
The awareness report might look impressive and attendance registers might be complete, but the cybercriminal is not interested in attendance statistics. Their focus is whether the door is still open. Increasingly, that door does not need to be opened through a suspicious email full of spelling errors.
Artificial Intelligence makes it easier to craft convincing messages, mimic voices and create deceptive content. A WhatsApp message requesting urgent financial help from a known contact or a notification threatening to block a mobile money account can prompt someone to act without verifying.
Cybersecurity awareness must therefore extend beyond memorising security slogans. People should understand how threats appear in everyday interactions and how to respond when faced with them. Knowing about phishing is one thing; recognising a convincing fraudulent message and resisting the urge to act is another.
Nonetheless, cybersecurity is not solely about individual behaviour. It equally concerns organisational governance, accountability, investment and operational resilience. Even the most cautious employee cannot compensate for outdated systems, excessive access privileges, unresolved vulnerabilities or inadequate monitoring. Awareness alone cannot fix an unpatched server or prevent the exploitation of a known vulnerability.
Policies may be approved, assessments conducted, risks documented and recommendations presented. Yet their true value depends on what happens afterward. Identified weaknesses must be addressed, recurring incidents must be analysed and security controls must be continuously evaluated. A vulnerability does not vanish simply because it has been noted in a risk register.
Instead of primarily measuring success by campaigns conducted, posters distributed or employees trained, more focus should be on whether awareness is influencing behaviour and strengthening security practices.
For individuals, this means developing everyday security habits: using strong and unique passwords, enabling multifactor authentication, keeping devices updated, verifying financial requests and reporting suspicious activities.
For organisations, it means integrating cybersecurity into daily operations rather than treating it as a periodic compliance task. Access rights should be reviewed, vulnerabilities addressed and incident response and recovery capabilities tested rather than just documented. Awareness should be reinforced year-round through practical exercises and lessons from real incidents.
Equally important, awareness initiatives must reflect how Ugandans interact with technology. A market vendor using mobile money, a student managing social media accounts, a parent making online school payments and a small business owner receiving digital orders face different risks.
Offering everyone generic advice about complex passwords may tick the awareness box without tackling their most pressing vulnerabilities.
The real value of Cybersecurity month lies in turning awareness into action and action into lasting habits and stronger controls.
Come November 1, the banners may come down, the webinars may end and communication teams may move on to the next campaign. Cybercriminals, however, will still be at work.