Weak and reused passwords are still the number-one door attackers walk through. “Credential stuffing” — automatically trying leaked username/password pairs from one breach against hundreds of other sites — works precisely because so many people reuse the same password everywhere.

In 2025, NIST (the U.S. National Institute of Standards and Technology) finalized a major update to its password guidance, SP 800-63B-4. The new guidance favors length over complexity: it recommends at least 15 characters for a password used on its own, drops the old requirement to mix uppercase, numbers, and symbols, and no longer recommends forcing periodic password changes unless there’s evidence of a compromise. It also calls for new passwords to be checked against lists of known breached passwords.

• Build passphrases, not passwords. Four or five random, unrelated words are longer, easier to remember, and harder to crack than a short string like “P@ssw0rd1!”.
• Never reuse a password across more than one account — especially email, banking, and social media.
• Let a password manager do the remembering. Tools such as Bitwarden, 1Password, and Dashlane (or your browser or phone’s built-in manager) generate and store a unique password per site, so you only need to remember one master password.
• Check whether you’ve already been exposed. Have I Been Pwned lets you search, for free, whether your email has appeared in a known data breach.

Two-factor authentication (2FA) asks for a second proof of identity beyond your password — something you have or something you are — so a stolen password alone isn’t enough to break in. Passkeys take this further: a passkey is a cryptographic key pair tied to your device and unlocked with your face, fingerprint, or PIN, so there’s no shared secret for a criminal to phish or steal in the first place.

Adoption has moved fast. The FIDO Alliance’s State of Passkeys 2026 report counted 5 billion passkeys now in active use worldwide, with 90% consumer awareness and 75% of people having enabled a passkey on at least one account. Passkey sign-ins also succeed far more often than password sign-ins — roughly 93% versus 63% — simply because there’s no password to mistype, forget, or have stolen. The same report found that about a third of consumers had an account compromise or breach notification in the past year, which is exactly the risk passkeys are designed to close.

• Turn on 2FA today for email, banking, and social media, choosing an authenticator app or passkey over SMS wherever it’s offered.
• When a service offers a passkey, take it — this is the direction the whole industry (Apple, Google, Microsoft, and major banks) is heading.
• Save your backup or recovery codes somewhere safe when you turn on 2FA, in case you ever lose your device.

Every operating system, browser, and app update patches security holes that are already publicly known — which means attackers actively scan for devices that haven’t installed them yet, because it’s the path of least resistance. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains an entire catalog of vulnerabilities that are actively being exploited in the wild, and a striking share of them had a patch available long before the breach happened.

• Turn on automatic updates for your operating system, browser, and mobile apps.
• Don’t forget the “invisible” devices — your Wi-Fi router, smart TV, and other connected gadgets need firmware updates too. Check the manufacturer’s app every few months.
• Retire software and devices once a vendor stops supporting them; end-of-life products stop receiving security patches entirely.
• Restart your devices regularly — some updates only finish installing after a reboot.

Phishing — a fake email, text, or call designed to trick you into handing over a password or money — is still the opening move behind the large majority of successful cyberattacks. What’s changed is the quality. Generative AI now lets scammers write flawless, personalized messages in minutes instead of hours: researchers running a controlled study found AI-written spear-phishing emails achieved a 54% click-through rate, compared with just 12% for traditionally written ones. Voice-cloning tools can mimic a real person’s voice from only a few seconds of audio, which is fueling a wave of fake emergency calls and impersonation scams.

Red flags to watch for

• Urgency or fear — “your account will be closed in 24 hours”
• A push to switch channels — “email me instead” or “call this number”
• A sender address that’s almost right, but not quite
• A link that doesn’t match the company’s real domain when you hover over it
• Any request for a password, one-time code, gift card, or wire transfer

If you spot one: don’t click. Go directly to the website or app yourself, or call the company using a number from its official site — never one provided in the message. If it’s “someone you know” asking for money or a code urgently, verify through a second channel, such as calling their actual phone number rather than the one that just contacted you.

Open Wi-Fi at airports, cafes, and hotels is convenient but easy to eavesdrop on. Anyone else on that same network can potentially intercept unencrypted traffic, and “evil twin” hotspots — fake networks named to look like the real one, such as “Airport_Free_WiFi” — are a common trick for capturing logins directly. A VPN (virtual private network) encrypts the connection between your device and the internet, so your traffic can’t easily be read by someone else sharing that network.

• Use a reputable, paid VPN with a clear, independently audited no-logs policy. Many free VPNs cover their costs by logging and selling browsing data, which defeats the purpose.
• At minimum, avoid logging into banking, email, or shopping accounts on public Wi-Fi without a VPN — use cellular data instead if you can’t verify the network.
• Turn off Wi-Fi auto-connect so your device doesn’t silently join unknown networks.
• Look for the padlock/”https://” in your browser bar; it encrypts your connection to that specific site, while a VPN protects everything leaving your device.

Every account you’ve ever signed up for is quietly holding a slice of your personal data, and default settings almost always favor sharing over privacy. Social-media account takeovers now make up a large share of reported identity-fraud cases, often because an attacker used publicly visible information — a birthday, a pet’s name, a hometown — to guess a password or answer a security question. A periodic privacy checkup closes those gaps.

• Review app permissions on your phone (location, camera, microphone, contacts) and revoke anything not essential to the app’s function.
• Set social profiles to private or friends-only, and check who can see your friends list, phone number, and past posts.
• Turn off ad personalization or limit ad tracking in your phone and browser settings.
• Delete old accounts you no longer use — forgotten services are still storing your data, and are just as capable of being breached.
• Put a recurring reminder on your calendar (quarterly is plenty) to redo this check.

Encryption scrambles your data so it’s unreadable without the right key — which matters most the moment a laptop or phone is lost or stolen. Both major operating systems include free, built-in full-disk encryption (FileVault on macOS and BitLocker/Device Encryption on Windows), and most modern smartphones encrypt automatically once you set a passcode.

• Confirm full-disk encryption is switched on for your laptop and desktop in your OS security settings.
• Set a strong passcode or biometric lock on every phone and tablet — an unlocked device makes encryption meaningless.
• Encrypt backups too, not just the live device. An unencrypted backup drive is just as exposed if it’s lost or stolen.
• For especially sensitive files, consider an encrypted folder or container — many password managers include one.

Scammers build profiles the same way marketers do: by piecing together small, publicly shared details. A vacation post reveals your home is empty. A “get to know me” quiz asks for your mother’s maiden name, first pet, and the street you grew up on — the exact answers to common security questions. None of it looks dangerous in isolation; the risk is in the sum.

• Post travel photos after you’re home, not while you’re still away.
• Skip social media quizzes and “fill in the blank” chain posts that ask for personal history.
• Think twice before sharing your full birthdate, phone number, or address publicly, even in a bio.
• Be selective about location tagging, and consider turning off geotagging in your camera app.
• Remember oversharing isn’t just social media — entering real details into every raffle, warranty card, and loyalty sign-up widens your exposure too.

Modern operating systems ship with solid baseline protection — Microsoft Defender on Windows, XProtect on macOS — which, combined with the habits above, is enough for most people. A firewall, also built into your OS, controls what’s allowed to connect in and out of your device, and should always stay switched on.

• Confirm your device’s built-in firewall is enabled (it usually is by default).
• If you want extra protection, pick one reputable antivirus tool rather than stacking several, which can conflict with each other.
• Be skeptical of unsolicited pop-ups claiming “your device is infected” — that’s frequently the scam itself, designed to sell fake protection or install real malware.
• Keep your security software updated too; outdated antivirus is only marginally better than none.

Ransomware, hardware failure, theft, and simple accidents all end the same way without a backup: permanent loss. The 3-2-1 rule is the standard baseline worth building around: keep 3 copies of important data, on 2 different types of media, with 1 copy stored offsite (cloud storage counts).

• Set cloud backup (iCloud, Google Drive, OneDrive, or a dedicated backup service) to run automatically rather than relying on remembering to do it manually.
• Keep one backup that isn’t permanently connected to your main network — ransomware can encrypt backup drives that stay plugged in.
• Test your backup occasionally by actually restoring a file. A backup you’ve never tested is a guess, not a plan.
• Encrypt the backup too (see Tip 7), especially one that leaves your home, like a cloud service or a portable drive.

Frequently Asked Questions