Cybersecurity habits wane in the holidays, but your employees aren’t being lazy or suddenly deciding they no longer care about security. They are, however, operating differently, and you probably are too.
As the end-of-year holidays get started, and travel and PTO plans solidify, take some time to do a short security reset with your employees framed around end of the year availability and circumstances. “Don’t forget your security training” isn’t going to cut it.
To combat these security shortcomings, reframing universal cybersecurity truths in these new contexts will help both business owners and employees stay sharp against cybersecurity threats.
1. Slow down when something wants you to hurry
Urgency is a tried-and-true tactic for scammers, and rarely is it more successful than during the holiday rush. With so many employees trying to finish up their tasks before heading out, an urgent request doesn’t seem out of place.
- “Can you take care of this real quick before you head out?”
- “Payment is needed by EOD today.”
- “I’ll be OOO the next two days. I need you to handle this before I’m back.”
When everything already feels urgent, urgent requests don’t stand out. But just like during the rest of the year, a manufactured feeling of urgency is designed to override your skepticism and lead you to act on instinct.
The more pressure there is to hurry, the more reason to stop and make sure everything checks out.
2. Verify the “quick favor”
Especially in high-stress months, most employees want to be accommodating and take care of requests quickly. This is doubly true of customer-facing workers fielding requests or personnel managers who are dealing with communication from many teams.
This is where cybersecurity best practices involve overwriting some impulses. ANY requests for sensitive information must be verified.
If you know the person “sending you” this request, contact them by phone or another trusted communication method. If they are a stranger, customer or you can’t get confirmation, follow an agreed-upon process to protect sensitive info while keeping regular operations.
Taking an extra minute to check a request will always be better than getting an answer out a minute faster, especially when that answer puts your business at risk.
3. Don’t let convenience take over when you travel
The risks associated with personal devices, shadow IT and unsecured public networks increase over the holidays and other travel-heavy times of the year.
Hotels, airports, cafes and other public places can introduce additional security risks. This doesn’t mean employees should be discouraged from getting work done in these places, but they do need to follow company policies for connecting securely.
Personal devices may similarly cause risks while employees are on the road. Defining what can and cannot be accessed from personal devices keeps the most sensitive information safe.
Even using the right device for the right task and connecting to the right network, shadow IT can be a concern. Shadow IT is programs used for business that have not been approved by the company. Before employees scatter for travel, reaffirm your policies so everybody knows what tools are approved for which tasks.
None of these precautions are here to penalize travel or employees using their PTO. They exist to account for the realities of remote work in these seasons and build habits around them.
4. Think before you click the holiday bait
Good morning! You picked up your phone and saw how many emails you got overnight.
- Shipping update: Gift arriving soon
- Travel itinerary for relatives who are coming for the holidays
- Confirmed! Your order has been purchased
- For being a valued customer, here’s 20% off your next visit
In all that noise, you might not even notice if you hadn’t bought anything in the past day that requires a confirmation email.
Even if it’s an email you’re expecting in your personal or business life, check the links and information to make sure everything’s above board. Even better, go directly to the familiar website or provider instead of following the link in an email.
Remember, phishing and other scams rely on you never stopping to consider that something could be amiss.
5. Know who to ask when something feels off
All of these ideas come down to one thing: knowing where to turn in the event of a potential cyberthreat. Even the most vigilant employee will encounter something they’re not quite sure how to handle, and when that happens, there needs to be an answer other than “try your best.”
Who needs to be contacted when a phishing message shows up? What is the reporting process? What needs to happen if a suspicious link is clicked?
These questions are bigger than one employee and may require coordination between the employee, technical or security teams, leadership, and outside vendors.
Knowing when to ask questions and who to ask is at the heart of all good cybersecurity hygiene and is the most important piece of this puzzle.
Nobody needs another hour-long training the week before the holiday
Quick reminders go a long way, but pulling everyone away from year-end work for another hour-long training session probably isn’t what your team needs right now.
Instead, keep the message brief, practical and relevant to what employees are likely to encounter over the holidays. Remind them to slow down, verify unusual requests, follow company policies while traveling and know where to turn when something doesn’t look right.
Leave the technical details to leadership and your IT team.
If your cybersecurity could use a check-in before holiday travel begins, we can help make sure things like remote access, device policies and reporting processes are ready for the season ahead.
Schedule a 10-minute discovery call and let’s take a closer look.
Call us at or visit our website https://www.ez-netsys.net/about-us/contact-us/.
Powered Services Pro, TMT and MSP Success sales and marketing resources and tools are provided to aid and promote the sales and retention of customer prospects and clients. Resources are meant as guidance and instruction and do not account for any laws, regulations or restrictions. We suggest you seek legal counsel where applicable.
Copyright and limited permissions granted by Kaseya. All sales or marketing samples and templates provided are to be used exclusively to promote or sell Kaseya products. ©2026 Kaseya Limited. All rights reserved. Kaseya and the Kaseya logo are among the trademarks or registered trademarks owned by or licensed to Kaseya Limited. All other marks are the property of their respective owners.
