This year’s themes ask us to secure what comes next and to stop making life easy for attackers. Three Merlin leaders explain what that takes in an era when AI has sped up both sides.
Every October, Cybersecurity Awareness Month gives organizations and individuals a reason to pause and review their defenses. This year it carries two themes: CISA’s “Securing the Next 250” and the National Cybersecurity Alliance’s “Don’t Make It Easy for Them.”
The first looks ahead, to stronger digital defenses and more resilient critical infrastructure. The second looks at today, at the everyday habits that block low-effort attacks and scams. At Merlin, we see them as two halves of the same job. Three of our leaders explain how, starting with why the pace of the threat changes everything.
It starts with pace. “For as long as I’ve been in the industry, cybersecurity has been an arms race between attackers and defenders. AI is putting that race into overdrive,” says Matt Hartman, Chief Strategy Officer. Attackers can now move faster, at greater scale, and with fewer resources than ever, while many organizations are still defending at human speed against threats operating at machine speed.
The most exposed part of any organization in that race is usually its people. Miguel Sian, Chief Technology Officer, puts it bluntly: “You are only as strong as your weakest link.” Humans tend to be that link, which makes them the most attractive targets, and AI has made phishing, smishing, and social engineering far more convincing.
Bob Costello, Chief Digital and Information Officer, sees the same shift. Scam messages are getting harder to spot, many now arriving with very convincing AI-generated voices.
The good news is that the fixes are within reach. “Make sure your devices automatically update, enable multifactor authentication on your important accounts, and most importantly, slow down,” Bob advises. That last step matters most, because phishing works by manufacturing urgency. When a message pressures you to click, share, or send money, pause and verify the official contact information yourself before you act.
Miguel makes the same case for organizations: strong passwords, MFA, and patching, backed by awareness across the whole user community. These habits can feel too basic for the AI era, but they take away the easy wins that attackers depend on, which is what this year’s NCA theme is about.
Habits are the foundation, but they aren’t the whole defense. Attackers are also using AI to find and exploit vulnerabilities faster, and as Miguel says, “You can’t protect what you can’t see.” Defenders can use the same technology to identify, remediate, and continuously test their defenses. They also need to accept that “it’s not a matter of if, but when.” Perfect prevention is impossible, so assume breach. That mindset pushes you to think like the adversary and moves you from reactive to proactive through zero trust, least privilege, and continuous monitoring.
The real-world consequences are hard to ignore. Attacks now reach everyday life, from supermarkets to water utilities. “It’s about protecting the services and infrastructure we depend on every day,” says Bob. “Neither government nor industry can do that alone, which makes information sharing, strong partnerships, and collective defense essential. For organizations without in-house IT, a managed service provider (MSP) can help close the gap.”
Matt’s challenge ties it all together. The conversation has to move “from simply recognizing the changing economics and pace of cyber threats to fundamentally rethinking how we defend against them.” In practice, that means not making it easy for attackers today, with strong credentials, MFA, scam awareness, and timely updates, while building the visibility, resilience, and partnerships to secure what comes next.
Cybersecurity is a shared responsibility, and we all have a role to play.
To talk with Merlin about strengthening your organization’s defenses, contact us here.