The holidays have a way of changing how we work.
People are traveling. Half the office is using PTO. Everyone is trying to finish “one last thing” before disappearing for a few days.
Cybercriminals know this too.
Your employees don’t suddenly stop caring about cybersecurity in December. They’re just distracted, moving faster and working in ways they might not during the rest of the year.
That makes the holidays a good time for a quick security reset.
And I do mean quick.
Nobody wants another hour-long cybersecurity training right before the holidays.
Instead, remind your team about a few simple habits that matter even more this time of year.
Scammers love urgency.
And during the holidays, everything already feels urgent.
“Can you take care of this before you leave?”
“Payment needs to go out today.”
“I’ll be out for the next two days. Can you handle this ASAP?”
Those requests sound perfectly normal in December.
That’s the problem.
Cybercriminals create urgency because they don’t want you to stop and think. So when a request is pushing you to act immediately—especially when money, passwords or sensitive information are involved—do the opposite.
Slow down.
A two-minute check can prevent a very long afternoon.
We all want to be helpful.
Unfortunately, scammers are counting on it.
An email that appears to come from your boss asking for sensitive information, a payment or some other “quick favor” shouldn’t get a free pass just because the name looks familiar.
Verify it.
Call the person. Send them a message through a communication method you already trust. Follow your company’s normal approval process.
And if you can’t verify the request, don’t guess.
Taking an extra minute to confirm something is legitimate is a lot easier than explaining later why $20,000 went to someone who definitely wasn’t your vendor.
Working from a hotel lobby, airport or coffee shop can be convenient.
Convenient and secure, however, are not always the same thing.
Holiday travel means more employees may be working away from the office. That can mean public Wi-Fi, personal devices and employees finding their own apps when the company-approved option isn’t handy.
That last one is called shadow IT—which sounds like a low-budget spy movie but really just means using technology the company hasn’t approved.
Before people start traveling, remind them how to connect securely, which devices they can use and which applications are approved for company information.
The goal isn’t to make working remotely difficult.
It’s to keep “I was just trying to get something done” from becoming the beginning of an incident report.
Your inbox gets noisy during the holidays.
Shipping notifications. Order confirmations. Travel updates. Discounts. Gift cards. Special offers.
And somewhere in that pile could be a phishing email hoping you’re too busy to notice something is off.
Before clicking, take a second look.
Were you actually expecting the message? Does the sender look right? Does the request make sense?
Better yet, if you get an email about an order or account, go directly to the company’s website instead of clicking the link.
Phishing works best when nobody stops to ask, “Wait, did I actually order that?”
Eventually, someone is going to see something suspicious and not know what to do.
That’s normal.
The important part is making sure the answer isn’t:
“Well…I guess I’ll click it and see what happens.”
Employees should know exactly who to contact when they receive a suspicious email, accidentally click a questionable link or notice something unusual.
Make the reporting process simple.
Your employees don’t need to become cybersecurity experts. They just need to recognize when something feels wrong and know who to ask for help.
Your employees are already trying to finish projects, cover vacations, buy gifts and remember where they put the wrapping paper last year.
Keep the cybersecurity reminder simple.
Slow down. Verify unusual requests. Work securely while traveling. Think before clicking. And speak up when something doesn’t look right.
Leave the complicated technical stuff to your IT and security teams.
If your cybersecurity could use a quick check before holiday travel begins, we can help review things like remote access, device policies and reporting procedures so your employees know what to do wherever they’re working.
Schedule a 10-minute discovery call and let’s make sure your security is ready for the holidays.