The most useful tips for any awareness day are the four CISA lists for everyone: report phishing, use strong passwords, turn on multifactor authentication with a password manager, and update software. For engineering teams, the work is turning each habit into a setting, a pipeline rule or a ticket.
Why start with four habits?
CISA's Secure Our World program reduces advice to four steps: avoid and report phishing scams, use strong passwords, use multifactor authentication and a password manager, and update software. The list is short on purpose. A habit people can remember beats a thirty page policy they never open.
Engineering teams have a twist. Developers hold more access than most staff: source control, cloud consoles, package registry tokens, CI secrets. One phished developer account can reach production. So the same four habits matter more here, and each needs a hard edge, not a reminder.
How do you make "use MFA" real?
A reminder email does nothing. A policy enforced at the identity provider does. Check three places that teams forget:
- The source control organization. Require MFA for every member, including contractors and bots with human owners.
- The cloud root or owner accounts, which often sit outside the normal single sign-on flow.
- Package registry publishing accounts. If an account can publish a library your customers install, it is a production account.
Constructed example: a team of twelve finds that eleven people use MFA on source control, and one long-standing contractor does not. That one gap is the whole risk. Counting people is not enough; you need the enforced setting.
What does a password manager change for developers?
It removes the reuse problem, and it gives you a place for shared credentials that is not a chat channel. It does not solve secrets in code. A password manager is for people. Machine credentials belong in a secrets manager or the CI platform's secret store, and a scan should check that they never land in a repository.
How should reporting phishing work in a small team?
Pick one address or one chat channel, and make reporting cost nothing. The rule that matters: nobody is blamed for clicking, everybody is thanked for reporting late. A person who fears blame will hide a click, and a hidden click is the version that turns into an incident.
Agree in advance what the reporter does next: change the password, revoke active sessions, and tell the channel what was entered and where.
What does "update software" mean in a build pipeline?
For individuals it means letting the phone update itself. For a software team it covers four layers: operating systems and laptops, build runners, language runtimes, and the libraries in your dependency tree. The last layer is the one that slips. A library with a known vulnerability can sit in a lockfile for years because nobody owns it.
Make it a standing task. Review dependency updates weekly, and treat advisories that affect code you actually call as urgent.
How to check or apply this
- List every system that holds production access: source control, cloud, registry, CI, ticketing. Mark which enforce MFA.
- Turn on enforced MFA where it is optional. Remove accounts that cannot comply.
- Choose a password manager and a separate secrets store, and write down which is for what.
- Create one phishing report channel and tell the team the no-blame rule.
- Schedule a recurring dependency and runtime update review with a named owner.
- Run a secrets scan across your repositories once, then on every pull request.
Where does Safeguard fit?
Safeguard scans dependencies and code, including secrets scanning, and can enforce policies and gates on pull requests. That covers the update and secrets items in the list. It does not replace MFA enforcement at your identity provider.
Quick check
Is a password manager enough protection on its own?
No. CISA pairs it with multifactor authentication. A password manager reduces reuse and weak passwords, while MFA protects the account if a password is stolen anyway.
Do machine credentials belong in a password manager?
Usually not. Use a secrets manager or your CI platform's secret store, and scan repositories to confirm no secret was committed.
Sources
Last reviewed: 18 October 2026.
