posted 27th October 2026
Security is often treated as someone else's job — the responsibility of a dedicated team, a set of tools, or an annual training module. But most security incidents don't begin with sophisticated attacks. They begin with everyday lapses: a reused password, an unpatched system, a link clicked in haste.
The uncomfortable truth is that attackers rarely need to be clever when everyday basics are left unguarded. For all professionals, including IT professionals, good security is a set of habits you practise every day, whatever your role. The habits themselves are simple; the value lies in doing them consistently. Here are five worth building, whether no matter your role in the organisation.
1. Treat Every Message and Link with Healthy Suspicion
Phishing remains one of the most common and effective attack methods precisely because it targets people, not systems. The habit to build isn't paranoia – it's a brief pause before you act. Check that the sender is who they claim to be, hover over links before clicking, and be especially wary of anything creating urgency. The same caution applies to unexpected phone calls and messages, not just email – attackers happily switch channels. Report anything suspicious rather than quietly deleting it; if one person received it, others probably did too, and flagging it protects the whole organisation.
2. Use a Password Manager and Multi-Factor Authentication Everywhere
Weak and reused passwords sit behind a huge share of breaches, and no amount of good intention makes memorised passwords secure at scale. The fix is boringly effective, and it's a habit rather than a one-off.
- A password manager: Lets you use strong, unique passwords for every account without trying to remember them.
- Multi-factor authentication: Adds a second barrier that stops a stolen password from being enough on its own.
- No exceptions for ‘low-value’ accounts: Attackers use minor accounts as stepping stones to important ones.
Set these up once and they protect you continuously, with almost no ongoing effort which is what makes them the highest-return habit on this list.
3. Keep Systems Patched and Up to Date
A large proportion of successful attacks exploit vulnerabilities for which a fix already existed – the patch simply hadn't been applied. Building the habit of updating promptly, both on your own devices and on the systems you're responsible for, closes off a huge category of risk for very little effort. Where you manage systems for others, a predictable patching schedule beats sporadic catch-ups, and it makes the occasional urgent, out-of-cycle update far less disruptive. The gap between a patch being released and applied is exactly the window attackers look for.
4. Apply the Principle of Least Privilege
People – including IT professionals – often accumulate far more access than they actually need, and every unnecessary permission is a potential liability. The habit here is to think in terms of ‘just enough’ access, both for yourself and for the users you support.
Grant the minimum privileges needed for the task, review access periodically, and remove permissions that are no longer required. It's worth applying the same scrutiny to service accounts and old logins, which quietly accumulate and are easily forgotten until they're exploited. It's less convenient in the moment, but it dramatically limits the damage if any single account is compromised.
5. Think Before You Share
A great deal of sensitive information leaks not through hacking but through carelessness – the wrong recipient, an insecure channel, an overheard conversation. A moment's thought before sharing prevents most of it.
- Check the recipient: Confirm you're sending sensitive data to the right person, over an appropriate channel.
- Mind your surroundings: Screens, calls, and documents are all readable by people around you, especially in public or shared spaces.
- Be cautious on untrusted networks: Public Wi-Fi and shared devices warrant extra care with anything sensitive.
When in doubt, default to the more cautious option – the mild inconvenience is almost always worth it.
Set the Standard for Others
Your habits don't only protect you – they shape the expectations of everyone around you. Colleagues and users take their cues from how others behave, and if you cut corners, they will too. Modelling good security consistently – locking your screen, questioning suspicious requests, handling data carefully – does more to build a security-conscious culture than any policy document. It also marks you out professionally as someone who can be trusted with access and who sets a good example.
Why Habits Beat One-Off Training
Annual security training has its place, but what actually reduces risk is behaviour repeated until it's automatic – pausing before clicking, reaching for the password manager, applying that update without being chased. Aim to build these one at a time until each becomes second nature, rather than trying to change everything at once. Habits are resilient in exactly the moments training isn't: when you're busy, distracted, or under pressure, which is precisely when mistakes tend to happen.
The Habits That Compound
The power of these five habits is cumulative: individually helpful, but together they close off the overwhelming majority of everyday risks that lead to real incidents. And unlike tools or policies, habits travel with you – they make you safer in every role, on every system, for the rest of your career. Building these habits isn't just good practice; it's part of being someone colleagues and employers can trust with the systems that matter.
At TSR Select, we specialise in Cyber Security recruitment alongside Cloud Computing and Managed Services.
If you're a security specialist or an IT professional looking for you next career move, we can help you find roles that fit your goals. Get in touch with us by emailing contact@tsrltd.co.uk or calling 020 3837 9180.
