Cybersecurity Tips for Employees: 8 Habits for Every Day

Much of cybersecurity comes down to daily habits, with expensive tools playing a smaller part. Information shared in an out-of-office reply, a note left on a desk or a QR code scanned without thinking can all be valuable opportunities for attackers. In this article we have gathered eight cybersecurity habits employees can easily practise every day.

1. Don't give away too much in your out-of-office reply

An "I'm out of the office" message tells an attacker how long you will be away and who is covering for you. Leave your deputy's contact details out of the external reply and simply say "For urgent matters, please call the office". Details and a sample message: What your out-of-office reply tells attackers

2. Use a long passphrase

The secret of a strong password is length. A passphrase of a few words, such as "No-mornings-without-coffee!", is far more resistant than a short, complex password. Our guide on how to create one: How to create a strong password

3. A different password for every account, and a password manager

A leak on a single site puts every account where you use the same password at risk. Use a password manager and keep multi-factor authentication turned on.

4. A one-minute check on Friday evening

At weekends response times are longer and attention is scattered. That makes it an ideal window for attackers. Take one minute before you shut down your computer:

• Log out: HR, banking and admin panels. A session left open is a door left open.
• Don't postpone updates: if there is an update you told to "remind me later", start it now.
• Check your desk: is there a sticky note, a backup MFA code or a handwritten password? Put it away.

5. Don't scan every QR code

Fraudsters place fake QR codes on restaurant tables, parcels and in emails. Scanning the wrong code can take you to a fake login page or make you download malware. This is called quishing. If you are not sure, don't scan; type the address yourself.

6. Treat unexpected post with suspicion too

A new type of fraud is appearing in Europe. Fraudsters print a fake bank card in your name and post it to you before your real card arrives. The letter asks you to scan a QR code to activate the card. The Bank of Portugal issued an official warning about this in October 2026.

Rule: if an unexpected card or an official-looking letter arrives, call the organisation on a number you already know, never the one in the letter. Activate cards only through the bank's own app or at an ATM.

7. Be careful on LinkedIn too

Professional networks are no longer a safe zone. According to ZeroFox data in APWG's report for the first quarter of 2026, 44 percent of social media threats in 2025 were impersonation and 27 percent were fraud, and threat volume grew across all platforms. A connection request, a job offer or an account that appears to be a "former colleague" can be part of this threat. Fake company pages and impersonated executives are also among the corporate risks.

8. Question your access rights

Access control is everyone's business, IT included. Ask these questions about your own account:

• Do I have access to systems I don't need?
• Do we use a shared account within the team?
• When I changed roles, were my old permissions removed?

If you notice unnecessary access, report it. Excess permissions make the damage bigger when an account is compromised.

Frequently asked questions

---
InfoLore offers awareness programmes that build practical habits like these with short, regular content. Get in touch to design a programme for your team.