Don't Let Security Habits Check Out for the Holidays: A Cybersecurity Checklist for Businesses

1. Slow Down When Something Wants You to Hurry

Urgency is a tried-and-true tactic for scammers, and it’s rarely more effective than during the holiday rush. With employees scrambling to wrap up tasks before heading out, an “urgent” request doesn’t raise red flags the way it normally would:

• “Can you take care of this real quick before you head out?”
• “Payment is needed by EOD today.”
• “I’ll be OOO the next two days. I need you to handle this before I’m back.”

When everything already feels urgent, urgent requests stop standing out. But just like the rest of the year, a manufactured sense of urgency is designed to override your skepticism and push you to act on instinct — a core pattern behind business email compromise and phishing attacks.

The rule: the more pressure there is to hurry, the more reason to stop and make sure everything checks out.

2. Verify the “Quick Favor”

In high-stress months, most employees want to be accommodating and knock out requests quickly. That’s doubly true for customer-facing workers and personnel managers juggling communications from many teams.

This is where cybersecurity best practices require overriding some very human impulses: any request for sensitive information must be verified.

• If the request seems to come from someone you know, contact them by phone or another trusted communication method.
• If it’s a stranger, a customer, or you can’t get confirmation, follow an agreed-upon process that protects sensitive info without grinding operations to a halt.

Taking an extra minute to check a request is always better than getting an answer out a minute faster — especially when that answer puts your business at risk. A structured security awareness training program with phishing simulations gives your team exactly this kind of verification habit.

3. Don’t Let Convenience Take Over When You Travel

The risks tied to personal devices, shadow IT, and unsecured public networks all increase over the holidays and other travel-heavy times of the year.

Hotels, airports, and cafes introduce additional security risks. That doesn’t mean employees shouldn’t work from these places — but they do need to follow company policies for connecting securely, ideally backed by managed network security protections like VPNs and next-gen firewalls.

Personal devices can create similar risks on the road. Clearly defining what can and cannot be accessed from personal devices keeps your most sensitive information safe.

And even when employees use the right device on the right network, shadow IT remains a concern. Shadow IT is any program used for business that hasn’t been approved by your company. Before everyone scatters for the holidays, reaffirm your policies so everybody knows which tools are approved for which tasks.

None of these precautions are meant to penalize travel or PTO. They exist to account for the realities of remote work in these seasons — and to build lasting habits around them.

4. Think Before You Click the Holiday Bait

Good morning! You pick up your phone and see the overnight flood:

• Shipping update: gift arriving soon
• Travel itinerary for relatives visiting for the holidays
• Confirmed! Your order has been purchased
• “For being a valued customer, here’s 20% off your next visit”

In all that noise, you might not even notice that you hadn’t actually bought anything requiring a confirmation email.

Even if it’s an email you’re expecting — in your personal or business life — check the links and sender information to make sure everything’s above board. Better yet, go directly to the familiar website or provider instead of clicking the link in the email. Strong email security with anti-phishing and BEC defense can filter much of this bait before it ever reaches an inbox.

Remember: phishing and other scams rely on you never stopping to consider that something could be amiss.

5. Know Who to Ask When Something Feels Off

All of these tips come down to one thing: knowing where to turn when a potential cyberthreat appears. Even the most vigilant employee will eventually encounter something they’re not sure how to handle — and when that happens, there needs to be a better answer than “try your best.”

• Who should be contacted when a phishing message shows up?
• What’s the reporting process?
• What needs to happen if a suspicious link is clicked?

These questions are bigger than any one employee. They require coordination between staff, technical and security teams, leadership, and outside vendors. If you don’t have that internal muscle yet, a co-managed IT partnership can help fill the gap with defined escalation and reporting processes.

Knowing when to ask questions — and who to ask — is at the heart of all good cybersecurity hygiene, and it’s the most important piece of this puzzle.

Nobody Needs Another Hour-Long Training the Week Before the Holiday

Quick reminders go a long way, but pulling everyone away from year-end work for another hour-long training session probably isn’t what your team needs right now.

Instead, keep the message brief, practical, and relevant to what employees will actually encounter over the holidays. Remind them to slow down, verify unusual requests, follow company policies while traveling, and know where to turn when something doesn’t look right. Leave the technical details to leadership and your IT team.

Get a Security Check-In Before Holiday Travel Begins

If your cybersecurity could use a check-in before the season starts, we can help make sure your remote access, device policies, and reporting processes are ready for the weeks ahead.

Schedule a 10-minute discovery call and let’s take a closer look — or explore our full range of IT solutions and managed services.