Cyber Hygiene in 2027: Which Habits Actually Determine a Company’s Security Level

Many people think that caring for security in a company is solely the job of the IT department. However, this is a shared effort with different approaches. 

On a personal level, it all comes down to strong passwords, caution with suspicious emails, and basic online hygiene. For business, on the other hand, it is an entire system: besides training people, it requires continuously monitoring risks, testing infrastructure resilience, and having a clear action plan in case of an attack. 

In this article, Yevhen Kurash, Sales Engineer at BAKOTECH, examines how these approaches work in practice and what to consider when protecting personal data and corporate infrastructure. 

How Have Cyber Threats Changed in 2026? 

In 2026, it is becoming increasingly easy for hackers to prepare attacks using AI, but many risks for business are still tied to human habits and misconceptions about cybersecurity. 

The Most Significant Changes in Attacker Behavior 

In my opinion, the main change is that attackers have become more independent. Previously, these were groups: hackers who worked in a team or united around a shared idea. That model hasn’t disappeared, but now nearly anyone can start hacking companies. 

Instead of forums and networking with “pros,” it is enough to message a “smart chat,” and AI will generate more effective attack methods. 

Although many generative models block direct requests like “help me hack something,” you can still bypass them with a cloaked prompt: cite ethical hacking and claim you need advice to test your own company. 

At the same time, one shouldn’t think that anyone can now become a top hacker and breach any company. However, launching a primitive attack has become significantly easier. 

Speaking of “loner hackers,” it is worth mentioning shadow AI—there are more and more such examples. An attacker can create their own AI system, deploy it locally, and train it. Instead of searching for a hacker community, they mostly need resources: computing power on a home computer or server, protection and anonymization of that server, and then loading their own model. 

Thus, thanks to open-source language models, attackers can independently build tools for cyberattacks without relying on turnkey solutions from hacker communities. And although this requires technical knowledge and additional setup, this approach is becoming increasingly accessible. 

Common Cybersecurity Misconceptions That Do Not Reflect Reality 

When companies consider cybersecurity, the first thing that comes to mind is business size. 

If a company is very small, its C-level rarely thinks about protection. But this way of thinking is already flawed. 

You should always think about cybersecurity and assess risks as soon as you take any action. When a person goes online, they must understand that threats exist there. 

With artificial intelligence, it is very easy to launch a startup—say, by developing services or releasing apps. Many small companies do not even consider that they are now a legitimate target for hackers, since a lot of information is publicly available. And if a business becomes profitable, it inevitably attracts those who want to breach it.  

Another dangerous misconception is that “you can protect yourself with a single tool.” 

Cybersecurity, and information security in general, is not about how many solutions you use to feel protected. It is about how many channels threats can enter through, and whether you address the risks associated with each. 

For example, the first channel is a malicious file downloaded onto a computer. The second is a phishing email. The third is a massive DDoS attack. The most important thing here is to know these risks and understand how to mitigate them, even if using free tools. 

From experience, I have noticed a misconception among companies that covering just one channel (e.g., installing antivirus) is enough and that everything will be fine after that. In reality, you need balance and different solutions for different tasks. A solution is not necessarily a product you can buy. It is primarily how a company chooses to address a specific risk and what it does to minimize it. 

Therefore, when building protection, we analyze all of this. Companies differ in their maturity and information processes. When communicating with clients, we try to understand their maturity level and financial resources, and help break down these cybersecurity misconceptions. Only after that do we offer a strategy tailored specifically to them. 

How a Single Employee Mistake Can Impact the Entire Company 

Organizations are constantly striving to automate everything to eliminate the human factor, which is so often the root cause of widespread issues. 

It is a common belief that machines do not make mistakes. We have already reached the point where we can establish control and eliminate routine tasks, but…  

As long as there is a human in the system, risk factors will always emerge. 

A careless attitude toward work is also considered a risk. Here, we are not talking about malicious activity—an insider within a company acts deliberately. We are talking about an employee who simply “overlooked” something. 

Let me give an example. A company uses a role-based access model where different people are responsible for different parts of the infrastructure, but some are higher in the hierarchy. These specialists hold elevated privileges and greater responsibility, and their work is sometimes critical to the company’s core operational survival. Therefore, a mistake by such a person can lead to catastrophic consequences.  

At the same time, even a veteran administrator who built all of the company’s services from the ground up can make a mistake. That is precisely why cybersecurity exists—to minimize the likelihood of such incidents.   

There are many solutions for role-based access. For instance, a user cannot perform an action without confirming their permissions. These systems operate on the principle of zero trust: you trust no one by default, and whenever an employee attempts a task, the system re-verifies the action and routes them appropriately. 

One such solution is DLP (Data Loss Prevention). It is designed for scenarios where an employee might inadvertently cause a data leak—for example, if a team member pastes confidential information into ChatGPT.   

There are also specialized products that automatically respond to incidents. For instance, software installed on an employee’s computer guides them on which data requires extra caution: it tags documents or analyzes their contents and makes real-time decisions on how to handle them. And when someone accidentally triggers a leak because they weren’t aware of a restriction (let’s be honest, who actually reads every instruction in full?), the system displays a full-screen warning explaining why the file cannot be sent, then blocks the action.  

AI and Social Engineering 

AI makes phishing attacks more convincing. So it is important not only to know about new threats, but also to know how to respond if something goes wrong. 

Social Engineering Scenarios That Are Hardest for Employees to Recognize 

New AI-driven elements, such as voice cloning or video generation, help attackers make attacks so realistic that victims easily believe them. 

So you need to ensure employees have a basic understanding of phishing and social engineering; even if they have only heard stories about someone being hacked via a suspicious message, that can build some awareness of the threat.

A little bit of statistics. 

Among AI hacking methods, the most prominent are AI-enhanced phishing and attacks on language models and AI agents themselves. In an experiment by a group of researchers—mostly from Harvard—fully automated AI emails achieved a 54% click rate, matching emails crafted by human experts, whereas traditional campaigns yielded only 12%. 

Regarding LLM attacks: in a Cisco study (May 2026), multi-turn attacks on 15 closed flagship models achieved a success rate ranging from 7.9% to 88.3%, while single-turn attacks ranged from 2.2% to 64.9%. Single-turn attacks achieve an intermediate or final goal in one step, whereas multi-turn attacks (combinations) are a sequence of interconnected actions in which the initial steps lay the groundwork for the decisive strike.   

However, in my view, artificial intelligence has not yet learned how to fool any person 100% of the time, and it is still a long way from that. 

Yes, voice or video cloning is already of quite high quality, but if you frequently consume such content online, you already know how to spot it. 

It is a different story when you suddenly receive a voice message supposedly from your wife or a family member asking you to transfer money urgently. The voice sounds familiar because the attacker found a publicly available sample. In that situation, a person can get flustered and not notice the swap right away.  

So How Should We Respond to AI-Related Changes? 

We must keep learning. 

No matter who you are or what profession you have, you need to understand what social engineering, phishing, smishing, deepfakes, and similar threats are. More and more people are using smart chatbots, so it is only logical to learn about the risks associated with these technologies as well. If such tools make tasks easier for you, they also make it easier for someone else to deceive you. 

A person can search for information online on their own. Still, turnkey solutions also exist where everything is structured: attack simulations from cybersecurity services, training courses, webinars, educational materials, and risks associated with artificial intelligence and LLM systems. 

Training should be simple. Not thousand-page regulations but short video lessons and even 3D games. You can even run a contest with prizes. Another effective option is running cyberattack simulations targeting employees. People should be encouraged to undergo training and motivated to be more cautious, because a small mistake by one person can become a massive problem for the entire company. 

We aim for employees to understand what kinds of messages can arrive, what risks and attack techniques exist, and what the attack chain looks like—for example, after clicking a suspicious link—so they don’t panic or get scared if something goes wrong.  

Every employee must have a clear, step-by-step action plan for a cyber incident, just like during a missile threat or an office fire. If computers are infected or an attack is suspected, administrators must provide concrete instructions.   

The same applies to social engineering: an employee must know what to do if they receive a suspicious message, notice an attempted manipulation, or have already clicked a link or visited a suspicious website.  

That is why specialized systems exist that combine training courses and phishing attack simulations. That is precisely what we offer: ready-to-use products you can purchase and tailor to your company’s needs.  

Useful Cyber Hygiene Habits That Actually Matter 

Solid protection begins with ordinary habits: how we use AI, how we create and store passwords, and how we work from personal devices. 

Habit #1. Safe Use of Generative AI 

Here, I analyze this from two perspectives: the business’s beneficial habits and those of the individual employee. 

The Business Side 

First and foremost, there must be a clear understanding of which AI tools are being used within the company, as this is rarely known to everyone. Companies often implement AI and encourage employees to adopt it, yet lack the tools to track who is using what, where, and how. 

AI tools differ depending on the version and can have varying vulnerabilities and limitations. This is particularly true in software development, where AI already plays a significant role in developers’ daily work. What matters here is not only the tool’s capabilities and its compatibility with the programming language, but also whether the code it generates might contain vulnerabilities. 

Businesses must also clearly define what data employees can share with AI and what is strictly off-limits. 

Therefore, a good habit is to monitor AI tools usage, know which versions are in use, and understand the associated risks.  

The Employee Side 

For an individual, this primarily means knowing the tool they are working with. You shouldn’t delegate every task to AI. My perspective is this: if you can work through a problem yourself, try doing it manually first.   

The output generated by AI should also be verified in multiple stages rather than accepting the very first response. You need to critically evaluate the result, verify its accuracy, and refine how you phrase your prompts—improving your approach to prompt engineering. 

It is best to combine several AI tools, compare their results, and analyze them yourself. 

At the same time, traditional internet searches, consulting other sources, and reading books remain as relevant as ever. All of this helps verify outcomes and form your own understanding of the topic. 

And of course, you should avoid using unknown, free, or Chinese AI services. Never upload personal photos, passport details, banking information, or passwords there.  

Habit #2. Proper Password Management Habits 

No password habits are unique today, except one: passwords must be very long and complex. 

The Business Side 

Regardless of whether a company purchases an off-the-shelf product or develops its own, authentication must be considered well in advance. 

Today, numerous solutions let companies centralize authentication. Regardless of which resources an employee uses, a single sign-on system applies: they register in one service, use a single password that rotates regularly, and use it to access all necessary services. This is extremely convenient, and the products we work with also include these tools. 

Therefore, a good habit for a company is to implement a system that provides for password rotation, complexity requirements, and multi-factor authentication.   

It might seem that almost everyone already knows about two-factor authentication, but in practice, it is not always given proper thought. Yet no better way to protect a password has been devised than verifying the user’s identity through a secondary channel. 

The Employee Side 

Previously, shorter passwords (up to 12 characters) were sufficient, but today it is better to opt for longer ones: 15 to 20 characters, and ideally even over 30. It is essential to mix uppercase and lowercase letters, numbers, and special characters.  

The most critical habit regarding passwords is changing them on time. 

Password rotation should be carried out regularly without waiting for the service itself to prompt you. I recommend setting a note or a calendar reminder. At the same time, it is worth checking whether the service supports the necessary password management mechanisms. 

Habit #3. Safe Use of Personal Devices, Public Wi-Fi, and Unauthorized Services 

The Business Side 

In today’s volatile environment, employees are often allowed to work from laptops and phones, including personal devices. This creates additional risks. 

In an office, everything is more controlled: cameras and other security measures make it difficult, for instance, to walk out with a monitor quietly. But an employee may work from home or travel with their device, and then the company no longer knows what is happening to it or where it might disappear. This immediately raises several questions: how to protect all these devices and which habits will help achieve this.  

A good habit for a company is to deploy software that verifies devices’ security posture. 

Mobile Device Management (MDM) solutions handle this function. For example, if a device has been offline for an extended period, an MDM system can remotely lock it or wipe corporate data.  

Besides, it is vital always to retain the ability to remotely connect to a company-issued device, even if the employee uses it personally (such as taking it on trips). This lets the company monitor device health, support the employee, remotely lock work data behind a password or wipe it, and ensure data encryption.  

Geolocation tracking is another option: if a device ends up somewhere it shouldn’t be but still has internet access, its location can be pinpointed remotely. 

A separate note regarding employee-owned personal mobile devices: work applications can still be installed on them, creating managed work profiles controlled by the company. Geolocation here is a different matter, as enabling location access is entirely up to the employee. However, you can configure security policies on these devices to verify whether a passcode is set, encryption is enabled, and the device complies with security standards. 

For instance, a device might have been bought on an online marketplace at a deep discount, only to turn out compromised: rooted or jailbroken in the case of an iPhone. This poses a major risk, particularly when granting access to corporate email, as it could be read not just by the employee but by anyone else with access to the device. Therefore, using an MDM system is a valuable habit, even for personal devices. 

The Employee Side 

The rules are essentially the same. If you use various services on personal devices, it is critical to maintain a unique password for each, rely on a two-factor authentication app, and enable 2FA wherever possible. For convenience, you can consolidate this into a single authenticator app.  

Keep a strong password on your device and change it regularly, and update your device hardware rather than sticking with the same model for ten years. 

Older operating system versions contain vulnerabilities that get patched through updates, making regular OS updates essential. 

Another useful recommendation is to avoid pirated software. For personal devices, this is standard digital hygiene: stay mindful of the resources you visit and the software you use. 

What Organizational Changes Should Be Made If You Want to Strengthen Security in 2027 

Ugh, organizational changes…  

The first change I would advise making is this: 

If a company doesn’t have an Information Security Officer, someone needs to be appointed to lead this domain.  

This person will look for ways to solve issues, select solutions—both free and paid—and assess risks for the company.  

An Information Security Officer must have relevant qualifications or specialized education. Having a certification is also desirable, as it matters significantly for this role. 

This option suits small businesses.   

In medium and large businesses, relevant departments and divisions usually already exist. From what I’ve seen, companies are establishing dedicated Security Operations Centers (SOCs) that monitor activity across the organization around the clock. People constantly analyze the situation, track signals and alerts, and oversee the company’s security day and night.  

The second change: 

Organize ongoing internal penetration testing to find the problem first and respond to it.  

If a company doesn’t try to breach its own systems, someone else might: an individual, a hacker group, or a neighboring country from which cyberattacks constantly fly in. And there is a high probability that this “someone from the outside” will succeed.   

Companies are typically familiar with pentesting as a service and outsource it. As a one-off service, it is quite expensive and usually conducted once or twice a year. This is an effective way to get an independent audit, but the point is to establish this practice internally. It could even be just one person: if the company lacks an information security department, an IT specialist, helpdesk technician, or system administrator can assume this role. 

Bug bounty programs are also worth mentioning. A large company can offer rewards for discovering vulnerabilities so that specialists can test its systems legally. Instead of suing people or ignoring their reports, the company pays for the vulnerabilities found. For example, an IT specialist in Ukraine with no affiliation to the company might want to earn money and test their skills. They test the company’s systems and may find a vulnerability the company is willing to pay for.  

Pentesting must be conducted regularly and in an automated manner, as a company’s assets change daily: the business grows, opens new offices or stores in other cities, expands its infrastructure, and launches new servers, products, and partner integrations. 

And I would love for all our companies to believe in this idea and adopt one of two approaches: either test their own systems from the inside, or allow other professionals to test them legally.