# Seven identity habits for every team, taken from what went wrong this October Source: https://startwithidentity.com/blog/identity-habits-for-every-team/ Last updated: 2026-10-22 License: content by Start with Identity. Cite the source URL. --- The identity habits that would have prevented most of October 2026's incidents are small: use a passkey where you can, let a password manager pick the rest, never approve a sign-in you did not start, and verify anyone who asks for access through a channel you chose. October is Cybersecurity Awareness Month, and [CISA's list](https://www.cisa.gov/cybersecurity-awareness-month) for everyone is four behaviors: recognize and report phishing, use strong passwords, turn on MFA and use a password manager, keep software updated. Below is the identity version, written for teams that are not security teams, with the incident that makes each one worth the effort. This is a page to share. Forward it to the finance lead, the help desk, the paid media team and the engineer who runs the build server. ## Key takeaways - A passkey cannot be typed into a fake site. That one property defeats the phishing kits that showed up this month. - A password manager is a phishing detector: it will not fill a password on the wrong domain. - An unexpected MFA prompt is an attack in progress. Deny it and report it. - A caller who knows your name, your manager and your employee ID has proven nothing. - Shared and partner accounts need the same rules as personal ones, because they are the ones nobody watches. ## 1. Use a passkey wherever it is offered A [passkey](https://startwithidentity.com/glossary/passkey/) is bound to the real website. If a page on the wrong domain asks for it, the browser has nothing to give. That matters because the phishing this month was live and interactive. Island described a platform posing as [AI advertising tools](https://startwithidentity.com/blog/2026-10-06-fake-chatgpt-gemini-and-claude-ad-portals-capture-credentials-and-mfa-codes/) where a human operator watched each victim and chose which MFA challenge to show next, relaying codes and approvals to the real service. Cisco Talos tracked [UAT-11985](https://startwithidentity.com/blog/2026-10-08-uat-11985-fake-event-invites-target-taiwan-researchers-with-google-aitm-phishing/) sending fake event invites that led to an [adversary-in-the-middle](https://startwithidentity.com/glossary/adversary-in-the-middle/) Google sign-in page. Against both, a typed code fails and a passkey holds. If your work account or your personal email offers passkeys, turn them on this week. A [synced passkey](https://startwithidentity.com/glossary/synced-passkey/) that follows you between your own devices is fine for most people; your security team will tell you if your role needs a hardware key. ## 2. Let a password manager choose and remember the rest Not everything supports passkeys yet. For those accounts, a [password manager](https://startwithidentity.com/glossary/password-manager/) does two jobs: it makes every password unique, and it refuses to autofill on a look-alike domain. If it does not offer to fill, stop and look at the address bar before you type anything. The reason for unique passwords is FortiBleed. The FBI and Secret Service warned on October 6 that the campaign is still [signing in to firewalls with reused or leaked credentials](https://startwithidentity.com/blog/2026-10-07-fbi-and-secret-service-warn-fortibleed-is-still-locking-out-victims/), no software flaw required. And the reason not to choose your own is Denmark: a person claiming responsibility for the breach of the national CPR register, covering about 8.8 million people, told Politiken that the company account they used had the password "123456". That claim is [not confirmed](https://startwithidentity.com/blog/2026-10-13-123456-password-linked-to-denmark-cpr-breach-of-8-8-million-people/), but nobody who has run a password audit is surprised by it. ## 3. Never approve a prompt you did not start [MFA fatigue](https://startwithidentity.com/glossary/mfa-fatigue/) works by sending push approvals until someone taps yes to make them stop, or by calling to say "you will get a prompt, just approve it." Neither is a real process. If your phone asks you to approve a sign-in you are not doing right now, deny it, and tell your IT or security team the same day, because it means someone already has your password. Number matching helps, but the operator-driven kits this month were built to relay those numbers too. The [push bombing breach](https://startwithidentity.com/breaches/mfa-fatigue-push-bombing/) teardown shows how quickly it escalates. ## 4. Verify through a channel you chose ASOS said its breach began when an attacker gained access to an employee account [by "impersonating a trusted contact to obtain log in credentials."](https://startwithidentity.com/blog/2026-10-08-asos-breach-began-with-an-employee-tricked-out-of-their-login/) Dexcom said [targeted vishing](https://startwithidentity.com/blog/2026-10-10-dexcom-says-targeted-vishing-led-to-access-to-internal-documents/) led to unauthorized access to information in internal documents. Neither involved a software flaw. The habit: when someone asks you for a code, a password, a reset or a change to payment details, end the conversation and contact them back through a number or channel you already had. Not the one in the email. Not the one they read out. For help desks, that becomes a rule, written down: no MFA reset or new device registration without a call-back to the number on file or a manager's confirmation through a separate channel. Our [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/) brief has a fuller checklist. ## 5. Treat one-time codes as something you only ever type, never say A [one-time password](https://startwithidentity.com/glossary/one-time-password/) by text or app is better than a password alone, and [two-factor authentication](https://startwithidentity.com/glossary/two-factor-authentication/) of any kind beats none. But a code is only safe on the site that asked for it. No bank, no IT team and no delivery company needs you to read a code aloud or paste it into a chat. If someone asks, that is the attack. ## 6. Give shared and partner accounts an owner The Danish case was a partner account with bulk search rights. FortiBleed hit device admin accounts. These accounts belong to a team, not a person, so nobody notices when the password is weak, MFA is missing, or the person who set it up left. Whoever runs your shared mailboxes, social media logins, ad manager accounts and supplier portals: list them, give each a named owner, move them into a team vault in the password manager, and turn on the strongest sign-in each one supports. ## 7. For anyone who builds software: your tools hold identities too Engineers have their own version. A coding agent can be [talked into reading secrets](https://startwithidentity.com/glossary/prompt-injection/) from your working directory, an agent's cloud role can be reached through the [instance metadata service](https://startwithidentity.com/glossary/instance-metadata-service/), and package publishing has moved to [trusted publishing](https://startwithidentity.com/glossary/trusted-publishing/), which is only as strong as the repository it trusts. Keep production `.env` files off machines where agents run, and treat write access to a release branch as a publishing credential. Our [developer toolchain analysis](https://startwithidentity.com/blog/developer-toolchain-is-the-identity-perimeter/) covers the detail. ## A ten-minute version for a team meeting If you have one slot this month, cover four things and stop: - Turn on passkeys for your work account and your personal email today. - Install the company password manager if you have not, and move shared logins into it. - If you get an MFA prompt you did not start, deny and report. Nobody should ever be in trouble for doing that. - Anyone asking for a code, password or reset gets a call back on a number you already had. ## Related reading - [MFA rollout guide](https://startwithidentity.com/guides/authentication/mfa-rollout/) and [how to choose an MFA solution](https://startwithidentity.com/guides/buyer-guides/how-to-choose-an-mfa-solution/) - [Passkeys 101](https://startwithidentity.com/guides/authentication/passkeys-101/) for colleagues who want the plain explanation - [Scattered Spider and help desk social engineering](https://startwithidentity.com/breaches/scattered-spider-helpdesk-social-engineering/) - [Vishing](https://startwithidentity.com/glossary/vishing/) and [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) in the glossary