Cybersecurity myths: seven questions for our security team

October is Cybersecurity Awareness Month, a global campaign with a simple job: help people pick up a few habits that actually make them safer online. The advice rarely changes; update the software, stop reusing passwords, think before the click. The harder part is that a lot of us already think we are doing that.

We all carry a cybersecurity myth or two. Last October, we asked the community which cybersecurity myths annoy you the most. The ones people can recite without thinking filled the list: a company too small to bother hacking, antivirus as a finished strategy, a known sender as proof an email is safe, a VPN as total privacy.

This year, we asked colleagues which cybersecurity myths they still hear, or still half believe. We collected those replies and chose seven of them for David Grandolfo, Defensive Security Coordinator, to answer. Each section below keeps the myth in the words that came in. His replies sit in the highlighted blocks, apart from the questions.

A complex password is enough

Password advice spent years on the same lesson: longer is better, symbols are better, and a password nobody could memorize is a password nobody could guess. Several colleagues described that lesson as a myth they still hear, or used to believe.

A 50-character password, with letters, numbers, and special characters, makes me untouchable.

A very complex password is enough, on its own, to protect my account.

For a long time, when I was younger and more naive, I thought a very complex password was all my accounts needed.

A passphrase is safer than a single word packed with special characters.

The first three treat complexity as the whole defense. One of them is offered as an old belief, the kind that feels obvious until it does not. The fourth argues about the shape of the password, a sentence rather than a symbol-stuffed word, and still puts the password itself at the center.

The question for our security team: does a very complex password, or a passphrase, protect an account on its own?

No. A complex password, or a random passphrase, does not protect an account on its own. The follow-up is predictable. MFA does not protect an account on its own either, and that is true well beyond a basic SMS code, which is easier for an attacker to capture.

There are several attack techniques, and one of them is password spraying. A complex password will reduce that kind of attack, or even stop it from discovering your password. In 2026, though, attackers capture the password instead, which is why phishing (asking you to fill in a form with your account and password) is one of the most popular strategies. Once an attacker has you enter the password, the length no longer matters. They have it, and they know your country. They then open a VPN in your country, to get around Microsoft’s security controls, and simply paste your password.

MFA does not fully protect you for the same reason. During that same technique, stronger attackers go further. They ask you to sign in “normally” on the Microsoft site, then capture your session token. That token can name the account, often your email, and it records that the MFA prompt already succeeded. It does not hold your password. Replaying it lets them act as you for as long as the session stays valid, and only inside what that account is allowed to open. A long, complex password does help. Add MFA. More important still, pay attention to where you enter your information.

We are all going to get caught

A few colleagues described a quieter way of opting out: the sense that it will happen anyway, or that they are too ordinary to be worth the trouble.

We are all going to get caught, sooner or later.

If someone skilled really wants into my account, or my computer, they will get in, even if I have antivirus.

I have nothing to hide, so I do not really need to worry about the data companies collect on me, what they do with it, or who they share it with.

Nobody would want to hack my account. I have nothing interesting there.

I have nothing worth stealing.

The first two treat a breach as a matter of time. A skilled attacker, in that picture, gets through anyway, antivirus included. The other three treat the person as too small, or too blameless, to matter. The colleague who passed along “I have nothing to hide” did not agree with it. If people saw how much companies can collect, share, and sell, they would be a lot less comfortable. It reaches further than most of us think, and even the person writing it suspected they would be surprised by the full list.

The question for our security team: is “we all get caught eventually” a fair description, or a reason to stop trying? If the attacker is skilled enough, does antivirus change the outcome? And does having nothing to hide, or nothing interesting, actually keep a person or an account off the list?

Not at all. It is true that we, or the company we do business with for our secured data, or our own company, will get hit one day or another. That is not a reason to publish your credit card number or leave your front door open.

Most attacks in 2025 were opportunistic. If it is easy, those are the first targets: the ones an attacker goes after for information and, above all, for money. That is exactly why you should pay attention. Not to the point of making yourself ill, but up to a level of comfort you can live with while protecting your personal data, so you do not panic when the day comes. Best case, be ready. Have someone you can call who can guide you, or steps already written down for the day all your passwords, or your banking details, are taken. Be prepared, rather than panicking when it happens.

Nothing is really 100% secure

Other colleagues started from the ceiling, then named what they would still put in the way.

Nothing is truly 100% secure. The practical goal is to put as many obstacles in an attacker’s way as possible, so they lose interest and move on.

In 2026, a good VPN and an antivirus on every device still matter.

Turning on multi-factor authentication is one of the most effective things I can do to protect my accounts.

A strong password on its own is not enough. Multi-factor authentication is essential, even though it cannot stop every attack.

The first reply sets the limit: perfect security is not on offer, so the job is friction. The others name the tools people still count on under that limit. A VPN and an antivirus, on every device, still in 2026. MFA as one of the most useful steps available. And, in the same breath, a warning that MFA is essential and still not a guarantee.

The question for our security team: if nothing is fully safe, which of these obstacles actually change the outcome? Where do a VPN, an antivirus, and multi-factor authentication still earn their place, and where do they get asked to do more than they can?

Nothing is infallible. That said, each tool protects you up to the level of comfort and expectation you set. Start by identifying where a hit would hurt the most. Someone learning your location. A virus that stops you working for two weeks. Losing your banking details and being defrauded. Once you have named that weak point, add security controls around it.

The minimum is straightforward: a complex password or a long passphrase, and never use the same password twice. MFA on every one of those accounts (long live free password managers). An antivirus that does not slow your work down (yes, that exists when it is configured properly). Put a little energy into applying that, and you can go back to your coffee or tea knowing you are protected in proportion to the effort you chose to spend, and that you are comfortable with where you landed.

Social engineering

Several colleagues put the main flaw on the person, not on the product.

The best protection is paying attention.

The main flaw in every computer system is the human, and how well they hold up against social engineering.

The biggest risk is never the technology. It is the habit. We invest in sophisticated tools and forget that about 90% of breaches still start with one click that was a little too fast.

Social engineering will always be the biggest way in.

The human is the central link.

One reply treats attention as the real control. Others call social engineering the door that stays open, and the human the weak point every system still has.

The question for our security team: is social engineering still the main way in, even when the tools are already in place?

Phishing is the most popular way to get access, and phishing is itself a form of social engineering. It works the best, unfortunately. There are several levels of attack, though. For a sophisticated attack, or for an advanced step in a particular scenario, other social-engineering techniques, beyond the phishing message, produce the most successful results.

Already for sale on the dark web

Four replies this time, all about personal information once it is no longer only yours: already for sale, reachable by AI, still online after a delete, or never shared in the first place.

Our personal information is already for sale on the dark web.

AI will never be able to access my personal information without my consent.

Once something is put online, it exists forever, even if it is deleted afterward. Privacy disappears online.

Putting as little personal information as possible on the internet is a good start toward keeping a life private. That includes email, documents stored in the cloud, and messaging conversations.

The first treats the sale as a fact. Your information is already out there. The second says consent is what keeps AI away from it. The third says deleting a post does not take it back, so privacy online is already gone. The fourth looks for a smaller footprint from the start: less email, fewer files in the cloud, fewer chats left online.

The question for our security team: is personal information already for sale for an ordinary person, and what does “already for sale” actually mean? Can AI reach that data without consent? Does deleting something online remove it?

A lot of information is available on attacker sites, but not everyone can reach it. There is the deep web and the dark web. The deep web is much easier to access. If your information ends up on the deep web, the trouble arrives faster and hits harder. In sophisticated attacks, the information ends up on the dark web and stays hidden most of the time, because it is worth money when it is resold. It will be used, yes. With good protections, such as protection on your credit file, you can react, or even block those fraudulent transactions. Good protection is never something to skip: it saves you a lot of trouble.

If the setting is off, the app stops

One colleague put their confidence on a checkbox that was right there: they switched it off, and in their mind the app has to obey.

If I toggle a setting OFF, there is no way the app keeps doing it. Right?

A setting set to off should mean something. The myth is treating the toggle as the whole story.

The question for our security team: when that setting is switched off, what can the app still do?

If the application feature is set to off, the application cannot perform the action you turned off. We have often seen, though, in tools (mainly SaaS), opt-out features become opt-in. Read the release notes, or check regularly, so you can confirm the security controls you put in place are still in place. Most companies are security-aware and will not put you at risk without telling you clearly and precisely.

Trust no one

One colleague answered with a rule rather than a myth: trust nothing you are told, check it, keep a backup, and run the service yourself.

Trust no one, verify always, backup everything, self-host.

It is a whole approach to being online: doubt the message, check it somewhere else, keep a copy, and keep the service in your own hands. A strict rule can still be trusted past the point where it helps.

The question for our security team: where does “trust no one, verify always, backup everything, self-host” hold for one person, and where does it create a new problem?

Diligence beats belief, obviously. A check that takes a few minutes can save a company several thousand dollars. A backup done properly means a backup of the backup, kept outside the company, with no path back to that copy from the company. That is what you need for a real safe copy. Local hosting is more secure only if you have stronger protection controls on your own platform. A local server that you open to the internet without a high-end WAF in front of it is not much protection. It is certainly not stronger than a company selling a SaaS product with several layers of protection above the application, layers meant to protect your data. That said, a local server with local-only access is much better protected than anything exposed to the internet. That part is certain.

If there is one thing to remember

Across the seven replies, the pattern is the same. No single control finishes the job, and none of them is useless. A long password, multi-factor authentication, an antivirus, a backup, and a setting switched off each hold up to a point. What keeps coming back is attention: where you type a password, whether a control is still on, and who you call when something goes wrong, as David Grandolfo put it in his words:

Cybersecurity does not rest on a single tool, or on a promise of perfect protection. It rests on simple habits, applied consistently. Use long, unique passwords in a password manager, turn on multi-factor authentication, keep your devices up to date, and stay attentive before you click, sign in, or share information. Antivirus, a VPN, backups, and privacy settings add useful layers, but they replace neither your judgment nor a minimum of preparation if an incident happens. Attacks often go after the easy opportunities. Making the attack harder, checking what looks unusual, and knowing who to turn to when something feels off: that remains the best defense.