3 Critical Cybersecurity Practices for Staying Safe Online

In today’s ever-changing technical landscape, you’re not just protecting your data from other humans. You’re protecting it from the generative AI tools they’re using to be faster, more cost efficient, and more personalized.

According to IBM’s cybersecurity study, “Cost of a Data Breach Report 2026,” AI-driven attacks increased 56% over last year’s study.

Despite all this technology, the study found attackers are still using some of the oldest tricks in the book. For the fourth year in a row, phishing is still the top method for attacking organizations.

Pixel Health works hard to help hospitals and healthcare practices protect themselves from cyberattacks. But employees at all levels play an important role in cyber safety.

We share three practical ways you can protect personal and patient information day-to-day.

1. Create strong passwords

As cyber threats are evolving and becoming increasingly sophisticated, employees should take steps to fortify their accounts with long, unique passwords and multifactor authentication. John Garcia, Senior Manager of Security & Engineering at Pixel Health, shared a few strategies.

“The length of a password matters more than its complexity,” he said. “Every person at a hospital or healthcare organization should be creating long, unique passwords, ideally passphrases made of several unrelated words. Forced symbols and character swaps tend to produce predictable passwords, while length makes a password significantly harder for attackers to guess.”

Hackers can attempt brute-force attacks, where they attempt many possible password combinations. John shared best practices for thwarting these attacks, which include:

• Turning on multifactor authentication (MFA) wherever it is offered, so a stolen password alone isn’t enough to get into an account.
• Using 14 or more characters, and favoring passphrases, which are long and easy to remember
• Avoiding common words, hackers often use dictionaries to crack passwords. Personal information, such as birthdays or names, should also be avoided. Passwords exposed in past data breaches should be avoided too, since attackers try them first, and many password managers can flag them.
• Creating unique passwords for each account to avoid the risk of one compromised account affecting multiple accounts.
• Using a password manager to securely keep track of different passwords.
• Changing a password right away if you suspect it has been exposed. NIST and Microsoft now recommend against routine scheduled changes, so follow your organization’s password policy on when to change them.
• Plan for passwordless sign-in. Passkeys and similar methods let staff type passwords less and resist phishing, which is the direction sign-in is heading

2. Recognize and report phishing attempts in business emails

In what is called “social engineering,” hackers will send seemingly personal or compelling messages to connect with their targeted victim, often creating a sense of immediacy and urgency to act. These messages are sent through email (phishing), text message (smishing), or over the phone (vishing). The victims may reveal sensitive information like passwords, credit card details, or personal information or even feel compelled to make fraudulent payments.

IBM’s cybersecurity study found social engineering was used in 13% of attacks and led to average breach costs of $5.23 million.

“Phishing is definitely still the number one cause for business email compromise,” said John. “For instance, one of our customers had an employee click through an email that appeared to be a Microsoft Teams document, and attackers used it to steal her credentials. They then used her account to send the same email to her coworkers, and the incident escalated. Messages like this are now easy to make convincing, so the goal isn’t to judge an email by how it looks. It’s to have habits and a reporting process that work even when a message looks legitimate.

John recommended that employees take steps to protect themselves from phishing with a few strategies:

• Be skeptical of links or attachments from unknown senders, and take extra care with unexpected messages from known senders, since their accounts may be compromised. Cybercriminals often mimic legitimate organizations.
• Check links before clicking by hovering the cursor over links to preview the actual URL (website address). Be cautious if the link doesn’t match the organization’s official website. Lookalike addresses can be hard to spot, so when in doubt, go to the website directly instead of clicking.
• Verify requests if an email asks for sensitive information or payment. Contact the organization directly using official contact information you already have, not details from the message.
• Don’t rely on spelling and grammar alone, because attackers now use AI tools to write polished, convincing messages. Judge a message by what it asks you to do.
• Recognize urgency and threats as typical methods for hackers to manipulate recipients into taking immediate action.
• Never approve a sign-in request you didn’t start. Don’t share a verification code with anyone, including someone claiming to be IT support.
• Report it, even if you have already clicked. Use your organization’s reporting process for suspicious messages, and tell IT right away if you clicked a link or entered your password. Fast reports limit the damage and let others be warned.

3. Maintain social media privacy

While social media can foster connections, it also exposes people to privacy risks. To maintain control over personal information and digital footprints, John shared several privacy-conscious practices:

• Regularly review privacy settings, and limit who can see posts, personal details, and friend lists.
• Be cautious with sharing personal information such as birthdates, addresses, or contact details, which can be used for identity theft.
• Limit what you share about your job, including your role, coworkers, vendors, and the systems you use, since attackers use these details to make phishing emails and phone calls more convincing.
• Review friend requests and only accept requests from people you know. You also want to make sure you review the profile thoroughly. An attacker can steal the photo of a friend to create a fake account in their name. Be cautious of links shared via private messages, which could lead to malicious websites.
• Enable multifactor authentication (MFA) for your social media accounts to add an extra layer of security by requiring a second form of verification in addition to a password.
• Be selective with third-party applications which grant access to your account. Review the permissions requested from your account and revoke access to those applications no longer in use.
• Consider private posts over public posts as public posts can be seen by anyone, including cybercriminals.
• Schedule regular profile cleanups to review friend lists and remove individuals if interaction is limited, or they are no longer considered trustworthy.

Proactively promote user awareness

“User awareness of cybersecurity is really key within healthcare organizations,” said John. “From secure sign-in practices to user training, security is everyone’s responsibility.”

Get in touch to learn more about how our team can help reduce your security risks—and keep your employees and data safe.