Cybersecurity advice is often reduced to simple rules: change passwords regularly, avoid public Wi-Fi, install antivirus software and enable two-factor authentication. These recommendations were created for good reasons, but the threat landscape and the technology protecting users has changed.
The problem is not that these safeguards have become useless. Instead, rigidly following outdated versions of the advice can create false confidence, encourage risky behaviour or distract users from more effective protections.
Here are four familiar cybersecurity habits that need to be reconsidered.
1. Changing Every Password on a Fixed Schedule
For years, organizations required employees to change their passwords every 30, 60 or 90 days. The intention was to limit the amount of time a stolen password could remain useful.
In practice, frequent forced changes can encourage people to select predictable passwords or make minor alterations, such as replacing “Password1” with “Password2.” This provides much less protection than organizations may assume.
The current NIST Digital Identity Guidelines advise service providers not to demand periodic password changes unless there is evidence that a password has been compromised. NIST instead emphasizes longer passwords, blocking commonly used or compromised credentials and permitting the use of password managers.
A better approach is to give every account a long, unique password generated and stored by a reputable password manager. A password should be changed immediately if it appears in a breach, is entered on a suspicious website or may have been exposed through malware.
Where available, users should also consider passkeys, which remove the need to remember a password and provide stronger resistance to phishing. Organizations reviewing password policies should combine these protections with measures designed to secure single sign-on systems against credential attacks.
2. Treating Every Public Wi-Fi Network as Equally Dangerous
“Never use public Wi-Fi” was once common security advice. However, widespread adoption of HTTPS means that most websites now encrypt information travelling between a device and the website.
The US Federal Trade Commission says that connecting through public Wi-Fi is usually safe because most websites use encryption. Users should still check for HTTPS and remember that an encrypted connection does not prove that the website itself is legitimate. A phishing website can also use HTTPS.
Public networks continue to present risks. Attackers may create convincing lookalike networks, manipulate captive-portal login pages or target devices with outdated software and exposed sharing settings.
Instead of avoiding every public network, users should:
Confirm the network name with the venue before connecting.
Disable automatic Wi-Fi connections and unnecessary file sharing.
Keep the operating system, browser and security software updated.
Avoid proceeding past browser certificate warnings.
Use cellular data or a personal hotspot for especially sensitive work.
Follow an employer’s approved VPN requirements when accessing company systems.
A trusted VPN can provide another encrypted layer, particularly for work traffic or applications that do not protect their own connections. However, a VPN transfers trust from the local network to the VPN provider and does not prevent phishing, malware or account compromise.
3. Assuming Antivirus Software Is a Complete Security System
Antivirus software remains an important protection and should not be disabled. The outdated habit is assuming that installing it is the only step needed to secure a device.
Traditional antivirus products relied heavily on signatures that identified previously discovered malicious files. Modern security tools also use reputation checks, behavioural analysis, cloud intelligence and other methods to identify suspicious activity.
Attackers nevertheless use techniques intended to evade detection, including frequently changing malware, malicious scripts, abuse of legitimate system tools and attacks that leave few conventional files behind. Artificial intelligence may help criminals modify malicious code more quickly, but malware evasion existed long before generative AI.
CISA’s ransomware guidance recommends keeping antivirus and antimalware tools updated while also using protections such as application allowlisting and endpoint detection and response. This reinforces an important point: antivirus should be one part of a layered defence.
For individual users, that means enabling the device’s built-in or another reputable security product, installing software updates promptly, downloading applications from trusted sources and maintaining backups. Businesses should add centralized monitoring, restricted administrative privileges, application controls and tested recovery procedures.
Running multiple antivirus products at the same time is not necessarily safer. They may conflict, reduce performance or interfere with each other’s detection capabilities.
4. Believing Any Form of Two-Factor Authentication Is Unbreakable
Two-factor authentication remains one of the most effective ways to prevent account takeover, and users should enable it wherever possible. The mistake is believing that every form of two-factor authentication provides the same protection—or that it makes an account impossible to compromise.
Text-message codes and one-time passwords can be captured through phishing. Attackers may also send repeated login approval requests in the hope that a user eventually accepts one.
Another threat is session theft. After a successful login, a website generally creates a session token or cookie that allows the user to remain signed in. Malware or adversary-in-the-middle phishing infrastructure can steal this token and reuse it without repeating the original authentication process.
Microsoft explains that stolen browser cookies can bypass authentication controls. This is why infostealers that collect browser data and authentication tokens remain dangerous, as demonstrated by the growing capabilities of threats such as the REMUS infostealer.
Passkeys and physical security keys provide stronger protection against phishing because authentication is tied to the legitimate website. CISA recommends moving toward phishing-resistant MFA, especially for important or privileged accounts.
However, even passkeys cannot make an infected device completely safe. Users and organizations must also protect endpoints, monitor active sessions, revoke suspicious sessions and require fresh authentication before particularly sensitive actions.
Security Controls Must Evolve With the Threats
The lesson is not to abandon passwords, public Wi-Fi precautions, antivirus software or two-factor authentication. Each remains useful when applied correctly.
The safer approach is to replace scheduled password resets with unique credentials or passkeys, assess public networks based on the connection and activity, treat antivirus as one security layer and choose phishing-resistant authentication whenever possible.
Cybersecurity habits should evolve as attacks and defensive technologies change. A safeguard becomes dangerous when users stop examining what it protects against—and assume that it can protect them from everything.
