It's 4:45 on a Friday afternoon. An employee gets an email that appears to come from a familiar vendor. There's an invoice attached, and the message says payment is overdue.
They're trying to finish up before the weekend. They open the attachment without looking closely at the sender's address.
It could be a legitimate invoice. Or it could be the beginning of a security incident.
Most employees aren't deliberately risking company information. They're answering emails, sharing files, managing passwords and trying to keep up with a busy workday.
Cybercriminals know that. They count on people being distracted, rushed or willing to trust something that looks familiar.
And while businesses invest in firewalls, antivirus software and other security protections, everyday habits can still create openings that technology alone may not prevent.
Here are five common workplace habits that can make a cybercriminal's job easier, along with simple changes that can help protect your business.
An email arrives from a delivery company about a missed package. Another says a Microsoft 365 password is about to expire. A third appears to come from the company president asking someone to review an important document.
Any of them could be legitimate.
The problem starts when employees respond automatically because the message looks familiar or sounds urgent.
Phishing emails are designed to make people act before they think. Some lead to fake login pages that collect passwords. Others contain malicious attachments or direct employees to websites that try to steal information.
And today's phishing messages don't always contain obvious spelling mistakes or awkward language. Criminals can create convincing messages that resemble everyday business communications.
A better habit: Before clicking a link or opening an unexpected attachment, check the sender's full email address and consider whether the request makes sense. If something feels unusual, contact the sender using a phone number or website you already trust.
Don't use the contact information provided in a suspicious message to verify that same message.
A few extra seconds can prevent a much bigger problem.
Remembering passwords for every business application, personal account and online service isn't easy.
That's why some employees reuse the same password across several accounts or make small changes to one they already know.
It may seem harmless, especially when the password is complicated.
But if a personal shopping website suffers a data breach, criminals may try the exposed username and password on business email, cloud applications and other services.
This is known as credential stuffing. Attackers test stolen login information against other accounts, hoping employees have reused their passwords.
A strong password loses much of its value when you share it across multiple accounts.
A better habit: Use a unique password for every work account and store passwords in an approved password manager. Enable multifactor authentication (MFA) wherever it's available, particularly for email, financial systems and remote access.
If your organization supports passkeys or phishing-resistant MFA, ask your IT team whether those options are available.
Employees shouldn't have to rely on memory or sticky n otes to manage dozens of passwords securely.
An employee is working on a report when an MFA notification appears on their phone.
They aren't trying to sign in anywhere, so they dismiss it.
A minute later, another request appears. Then another.
Eventually, they tap Approve, assuming an application is having trouble connecting.
That one tap could give an attacker access to their account.
In an MFA fatigue attack, a criminal who already has someone's password repeatedly triggers authentication requests, hoping the employee will approve one to stop the interruptions.
Multifactor authentication remains an important security measure. The danger comes when employees treat approval requests as routine notifications instead of security checks.
A better habit: Never approve a sign-in request you didn't initiate. If unexpected requests keep appearing, deny them and contact your IT team immediately.
Businesses should also consider stronger authentication methods, including number matching and phishing-resistant MFA where supported.
An employee needs to send a spreadsheet to a coworker. They upload it to a shared folder, copy the link and send it over.
The file reaches the right person, and the task is complete.
But what if the link allows anyone who receives it to open the document? What if the folder still includes former employees, outside contractors or people who no longer need access?
Convenient sharing settings can expose more information than intended.
The risk grows when files contain customer details, financial records, employee information or confidential business plans.
A link doesn't have to be posted publicly to cause trouble. Someone can forward it, send it to the wrong person, or access it even after their permissions were removed.
A better habit: Before sharing a file, check who can open it and whether they actually need access. Use organization-approved sharing tools and choose specific recipients instead of broadly accessible links whenever possible.
Your IT team should also regularly review shared folders and permissions, especially when employees change roles or leave the company.
The easiest sharing option isn't always the safest one.
A computer displays a message that an update is ready to install.
The employee is in the middle of something, so they click Remind Me Later.
The next day, they do it again.
Software updates aren't always convenient. They can interrupt work, require a restart or arrive at the worst possible time.
But some updates fix security vulnerabilities that criminals may already know how to exploit.
Delaying those fixes can leave computers, browsers and business applications exposed longer than necessary.
The same applies to security warnings. Employees may dismiss unfamiliar alerts because they're unsure what they mean or don't want to interrupt their work.
A better habit: Install approved security updates promptly and restart devices when required. If an update causes problems or a warning seems suspicious, contact IT rather than repeatedly dismissing it.
Businesses can make this easier by managing updates centrally, scheduling maintenance outside busy periods and explaining which alerts employees should report.
Security shouldn't depend on every employee remembering to update every device.
Even careful employees can click the wrong link, share a file with the wrong person or approve a request they shouldn't have.
What happens next matters.
If an employee suspects they've made a security mistake, they should report it to their IT team or designated security contact immediately.
They shouldn't wait to see whether anything unusual happens.
An early report gives IT a chance to investigate, secure affected accounts, check for unauthorized activity and determine whether additional action is needed.
Employees should also know that reporting a mistake is better than trying to handle it quietly.
A business with a clear reporting process and strong cybersecurity awareness training can respond faster than one where employees are afraid to speak up.
You don't need every employee to become a cybersecurity expert.
You do need them to recognize a few common warning signs, understand how their everyday decisions affect company information and know whom to contact when something seems wrong.
That starts with practical training, sensible security settings and clear expectations.
A quick reminder before opening an attachment, a unique password, a denied login request or a properly shared file may seem like a small action.
But these habits make it harder for criminals to exploit an ordinary workday.
This Cybersecurity Awareness Month, Fraser's message is simple.
Don't Make It Easy For Them.
Employee awareness is an important part of cybersecurity, but it's only one piece of protecting your business.
If you're unsure whether your technology, account protections and security practices keep pace with today's threats, Fraser's Free Technology Risk Assessment can help you identify gaps and understand where improvements may be needed.