October is Cybersecurity Awareness Month, and this year we want to talk about the part of security that never shows up on a network diagram: your people.
Most organisations in Singapore have invested heavily in firewalls, endpoint protection and monitoring. Those controls matter. But every one of them can be quietly sidestepped by a single convincing email, a rushed click or a password typed into the wrong page. That is why our theme for this month is simple: your people are your first line of defence.
This is not about blaming employees. It is about recognising that the people in your organisation see threats first, often before any tool does. With the right awareness and the right support, they can stop an attack at the door.
Why attackers go after people first
Attackers follow the path of least resistance. Breaking through well-configured technical controls takes time, skill and luck. Persuading one person to open an attachment, approve a payment or share a login takes a well-written message.
That is why social engineering remains one of the most common starting points for breaches. A typical attack does not look dramatic. It looks like:
-
- an urgent email that appears to come from a senior leader asking for a quick bank transfer
-
- a “password expiry” notice that leads to a fake Microsoft 365 login page
-
- an invoice from a familiar supplier with updated bank details
-
- a phone call or WhatsApp message from someone claiming to be IT support
Each of these relies on the same things: trust, urgency and a busy day. Technology can filter some of them out. People are the ones who catch what slips through.
Learning to recognise phishing
Phishing has become more polished. Messages are well written, logos look genuine and some are tailored to the recipient using details from LinkedIn or company websites. AI tools have made convincing fakes even easier to produce. The good news is that most phishing still leaves clues for anyone who knows where to look.
Encourage your teams to pause and check for these warning signs:
-
- Urgency or pressure. “Act now”, “your account will be suspended” or “I need this done before the meeting”.
-
- A sender that doesn’t quite match. The display name looks right, but the email address or domain is slightly off.
-
- Unexpected requests involving money or credentials. Changes to bank details, gift card purchases or requests to log in through a link.
-
- Links that go somewhere else. Hovering over a link (or long-pressing on mobile) shows a different web address from the one you expect.
-
- Attachments you weren’t expecting. Especially invoices, “scanned documents” or files that ask you to enable macros.
-
- A tone that feels unusual. A colleague who normally writes casually suddenly sounds formal, or the other way round.
When something feels off, the safest step is to verify through a separate channel. Call the person on a number you already have, or check directly in the official system, rather than replying to the message itself.
Why reporting matters more than perfection
No one spots every phishing attempt, and no organisation should expect them to. What makes the real difference is how quickly a suspicious message is reported.
A single report can let your security team block a malicious domain, pull the same email from other inboxes and warn everyone else before more people click. A delayed report, or no report at all, gives an attacker valuable time.
That is why reporting should be:
-
- Easy. A one-click “Report phishing” button in the email client, or a single, well-known address or channel.
-
- Fast. Employees should know that reporting quickly matters more than being certain it is malicious.
-
- Blame-free. Someone who clicked a link and reports it straight away has done the right thing. If people fear getting into trouble, they stay silent, and silence is what attackers rely on.
-
- Acknowledged. A short “thank you, we’ve looked into it” reply encourages people to keep reporting.
It also helps to make the same point for things beyond email: unusual login prompts, unknown USB drives, unexpected calls asking for information, or a device that suddenly behaves strangely.
Building a security-first culture
An annual training video and a policy document are not a culture. A security-first culture is one where good security habits are simply part of how people work, and where everyone, from the boardroom to new joiners, sees it as their responsibility.
A few things consistently make the difference:
-
- Leadership goes first. When senior leaders complete the same training, follow the same rules and talk openly about security, everyone else takes it seriously.
-
- Training is continuous, not once a year. Short, regular sessions and realistic phishing simulations build instinct far better than a single long course. Results show where extra support is needed, without singling anyone out.
-
- Content fits the role. Finance teams face invoice and payment fraud. HR handles personal data. IT staff are targets for credential theft. Awareness works best when it reflects the risks each team actually sees.
-
- Security is easy to do right. Password managers, multi-factor authentication and clear processes for approving payments remove friction, so the secure choice is also the convenient one.
-
- Good behaviour is recognised. Thanking the person who reported a convincing phishing email does more for culture than any reminder.
For organisations in Singapore, this is also a matter of trust and compliance. Customers, regulators and partners increasingly expect proof that people, and not just systems, are part of the security programme, particularly for businesses handling personal data under the PDPA or operating in regulated sectors.
Five things you can do this month
Cybersecurity Awareness Month is a natural moment to start, or restart, the conversation. Here are five practical steps that don’t need a large budget:
-
- Run a phishing simulation. A realistic, well-timed campaign shows how your teams respond today and gives you a baseline to improve on.
-
- Make reporting obvious. Confirm every employee knows exactly how to report a suspicious message, and make sure someone responds to those reports.
-
- Switch on multi-factor authentication everywhere it’s available. Prioritise email, remote access, finance systems and admin accounts.
-
- Hold a short leadership briefing. Fifteen minutes on current threats and the organisation’s role in preventing them sets the tone from the top.
-
- Share one simple message, often. For example: “If it’s urgent and unexpected, verify it first.” Repeat it in team meetings, internal channels and email signatures throughout the month.
Security is a team effort
Technology will always be essential, but it works best alongside people who are alert, confident and supported. When employees know what to look for, feel safe reporting it and see leaders taking security seriously, they become one of the strongest controls an organisation has.
At ATET, we help organisations across Singapore strengthen both sides of that equation. Our managed SOC monitors and responds to threats around the clock, our penetration testing finds gaps before attackers do, and our phishing simulation and security awareness programmes help your people recognise and report threats with confidence.
This Cybersecurity Awareness Month, make your people part of your defence strategy. Get in touch with our team to talk about a phishing simulation or awareness programme for your organisation.