Cybersecurity Month 2026: six jobs for your infrastructure

October is European Cybersecurity Month. Over these weeks you'll see phishing posters, a quiz for colleagues and perhaps a webinar. All fine, but if you're responsible for servers and networks the question is a different one: what do you actually get done on your own infrastructure this month? Below are six jobs that each fit in an afternoon, and that also add something to your file under NIS2 and the Dutch Cyber Security Act.

What's happening this month

European Cybersecurity Month (ECSM) has existed since 2012. ENISA started the campaign; today it is carried by the member states and by public and private organisations, with ENISA and the European Commission in a supporting role. The 2026 European focus is on employees: according to a Eurobarometer survey, three in four employees have received suspicious messages or links.

In the Netherlands the month runs through Alert Online, an initiative of ECP with the Ministry of Economic Affairs and the NCSC. The kick-off on 1 October had a theme that speaks to us more than the usual awareness message: "when it goes wrong anyway". Not just prevention, then, but keeping things running and recovering. The list below follows that line.

Six jobs for October

• Clean up admin accounts — go through every system with administrative rights: routers, firewalls, hypervisors, BMCs, your DNS provider, your supplier portals. Who still has access but no longer works here? Who logs in with a shared account? Turn on passkeys or another phishing-resistant second factor wherever you can, starting with the accounts that can do the most. In our dashboard you give colleagues their own accounts with exactly the rights they need; for our own staff a passkeyPasskey Signing in with a cryptographic key on your device instead of a password. Phishing-resistant, because the key only works on the real website. is mandatory there. You can read more about passkeys for admin accounts in our knowledge base later this year.
• Patch status at the edge — list everything that faces the outside: firewalls, VPN concentrators, edge routers and the firmware of your BMCs. Note the version and the date of the last update for each device. These are exactly the devices where vulnerabilities get exploited fastest. If your network configuration lives in version control, you already have most of that inventory. How to follow a fixed process after a CVECVE Common Vulnerabilities and Exposures: the public identifier of a known vulnerability, such as CVE-2024-12368. in your router instead of improvising is something we cover early next year.
• Check DMARCDMARC DNS record that tells receivers what to do with mail that cannot be proven to come from your domain: nothing, quarantine or reject (p=reject). — dig TXT _dmarc.yourdomain.com shows where you stand in seconds. No record, or p=none with nobody reading the reports, means anyone can send mail in your name. Our own domain is on p=reject with strict alignment. How to get there without breaking your own mail, you can read in our knowledge base in November.
• Separate management from production — a BMC or management interface on a public IP is the fastest route to full control of your server. Check that your management interfaces are only reachable through a separate network and a VPN. How we do it is described in out-of-band management with WireGuard.
• Update your escalation matrixEscalation matrix Overview of who to call during an incident, through which channel, and who is next if they do not respond, per supplier and per service. — record per supplier and per service who you call during an incident, through which channel, who is next if they do not pick up, and how quickly they in turn inform you. Put your own side in too: who decides, who reports to the supervisor and who talks to customers. If your organisation falls under NIS2, your 24-hour clock starts the moment you know; a supplier who only tells you after two days costs you that margin. We report incidents to customers within 8 to 12 hours. Also agree what happens during a DDoS attack: what you arrange in advance saves a lot of phone calls when it happens.
• Restore a backup — pick one system that matters and restore its backup onto a separate machine, until you have a working service at the end. You are not only testing whether it works, but also your expectations. How long does the restore really take? How much data have you lost since the last backup? And can you get running again with this backup alone, or do you depend on the knowledge of that one colleague? Often the backup turns out not to be enough: you also need an unseal keyUnseal key Key (or a share of one) needed to open an encrypted vault such as HashiCorp Vault or OpenBao after a restart. Without it, a restored backup is unusable., a password from a vault that itself ran on the system, or the Ansible code that starts the process again. Write down what was missing. A backup you have never restored from is an assumption.

What's not on this list

What's missing: a penetration test, a SOCSOC Security Operations Centre: monitors systems for attacks and abuse and investigates security incidents. Not the same as a NOC., detection. That's deliberate. They have their place, but they add little while the basics above aren't in order. A pentester who finds a forgotten admin account is telling you something you could have found yourself in an afternoon.

We don't do penetration testing ourselves and we have no SOC. The difference between a NOCNOC Network Operations Centre: monitors the availability and operation of networks and responds to outages. Not the same as a SOC. and a SOC, and what you can expect from your network partner during an incident, is the subject of a separate article this autumn.

Where we fit in

We supply the infrastructure half. Every IP transit connection includes basic DDoS protection through Levatio, our own mitigation stack; in practice it often steps in within seconds, though that's not a guarantee. On managed servers we patch critical vulnerabilities within seven days and high ones within thirty, as an upper limit. With NOC as a service we keep an eye on your network, and what you can expect from us during outages is in the SLA.

Filling in a customer's supplier questionnaire this month as well? Our answers are on your infrastructure supplier under NIS2. If you'd like help with any of the jobs above, get in touch.