It is Cybersecurity Awareness Month, and this year’s theme, “Building a Cyber Strong America,” is a good excuse to ask business owners across Lancaster County and Central Pennsylvania a blunt question: would your team recognize an attack that does not look like a typical phishing email? Attackers have moved to channels people trust more and scrutinize less, and the numbers back up why that matters, especially for small and mid-sized businesses that assume they are too small to be a specific target.
Your Team Is Still the Deciding Factor
Verizon’s 2026 Data Breach Investigations Report found the human element was present in 62 percent of breaches, and mobile-based phishing, texts, voice calls, and messaging apps, is succeeding roughly 40 percent more often than traditional email phishing tests. Attackers have simply gone where people are more distracted and more trusting.
MFA Is Being Routed Around, Not Broken
A more targeted technique is gaining traction: OAuth 2.0 consent phishing, where an attacker tricks a user into approving what looks like a legitimate app authorization request instead of stealing a password outright. The resulting authorization code hands over account access without ever triggering a traditional MFA prompt. One documented case moved from a fake WhatsApp outreach to a fully compromised mailbox in under four hours, with no password ever entered and no traditional red flag along the way.
Watch Andy Smith discuss security operations and the threat landscape. Security Operations & Threat Landscape.
Unpatched Systems Are the Quiet Second Front
Exploiting software vulnerabilities is now the leading way attackers get in, overtaking credential abuse for the first time. The median time to patch a known vulnerability climbed to 43 days, even as attackers weaponize new flaws within hours of disclosure, a window wide enough for a known issue to sit exposed for weeks after a fix already exists.
Cloud Accounts Are Now Worth Real Money to Attackers
Threat hunters have tracked a sharp rise in attackers hijacking cloud credentials for cryptomining and to reach digital financial assets, in one case mining tens of thousands of dollars before detection. CISA’s Cybersecurity Awareness Month resources are a useful baseline for closing that risk.
What This Means for Your Business
You do not need to defend against every technique in a nation-state threat actor’s playbook. You need the fundamentals in place and verified, not assumed.
- Patch known exploited vulnerabilities first, not oldest to newest. A flaw already being used in active attacks is a different priority than one that is simply old.
- Move toward phishing-resistant MFA and monitor for new device or app registrations. A one-time approval prompt does not protect you the way it did two years ago.
- Apply least-privilege access to every cloud account, not just on-premises systems. Cloud accounts are now a direct target, not an afterthought, and a compromised login there can be worth more to an attacker than one on a local machine.
- Train your team on mobile and messaging-based phishing, not just email. A test that only covers email leaves the fastest-growing attack channel uncovered.
- Test backups and incident response steps before an actual incident forces the test. A plan nobody has practiced is a guess, not a plan.
See Where Your Team and Systems Really Stand
None of this requires a security team the size of a national bank. It requires knowing where these five fundamentals stand today, not where they stood the last time someone checked, and a willingness to update your team’s training past the email-only phishing test most businesses still run.
Plenty of providers run a generic annual security review and call it done. TCW-GAV‘s differentiator is that a cybersecurity risk assessment here means the same kind of hands-on review behind the results our clients have seen firsthand, not a checklist exercise. The same 24/7 monitoring and cybersecurity protection is built into TCW TotalCare for Lancaster and Central PA businesses.
Book a Discovery Discussion and get a clear picture before an attacker finds the opening themselves.
FAQ
- What is Cybersecurity Awareness Month?
Cybersecurity Awareness Month runs every October and is co-led nationally by CISA and the National Cybersecurity Alliance. The 2026 theme, Building a Cyber Strong America, focuses on the small and mid-sized businesses that support the infrastructure and services communities depend on every day.
- What is OAuth consent phishing?
It is a phishing technique where an attacker tricks a user into approving a fake app authorization request instead of stealing a password directly. Because it hands over an authorization code rather than credentials, it can bypass traditional MFA prompts.
- Is multi-factor authentication still worth using?
Yes. MFA still blocks the large majority of basic credential attacks. The rise of OAuth phishing means it should be paired with phishing-resistant methods and monitoring for new device or app approvals, not replaced.
- Why are vulnerabilities overtaking stolen passwords as an entry point?
Attackers are weaponizing newly disclosed vulnerabilities faster than most organizations can patch them. The 2026 Verizon DBIR found the median time to patch rose to 43 days, giving attackers a wide window of opportunity.
What should a Lancaster business do in the first hour after being hacked?
Disconnect affected devices from the network but leave them powered on, don’t respond to the attacker, change passwords from a separate clean device, and call your IT provider right away.
Those first steps limit how far the attacker can move and preserve the evidence needed to recover.