Is your digital
life secure?

Most "forgot password" flows send a reset link to your email. If an attacker gets into your email, they own every account linked to it — banking, social, work, everything. MFA adds a second layer that stops attackers even if they have your password.

Financial fraud is often automated. Once credentials leak in a breach, bots attempt logins within hours. MFA buys time and stops most automated attacks entirely.

Humans can't memorise unique 20-character passwords for 50+ accounts. Without a manager, we reuse passwords. When one site gets breached, credential stuffing attacks try that same password everywhere else.

Billions of credentials from past breaches (LinkedIn, Adobe, Canva, etc.) are freely available on dark web forums. Attackers use these lists in automated attacks. Knowing you're exposed means you can act first.

Compromised social accounts are used to run scams on your contacts, spread misinformation under your name, or even for identity fraud. They can be very hard to recover once lost.

Security patches close known vulnerabilities. Attackers actively scan for devices running old software. Being even one major version behind can expose you to public exploits.

Browsers and office software are the most common attack vectors. Ransomware often enters through unpatched software vulnerabilities.

Physical theft or "shoulder surfing" is still a major attack vector. An unlocked phone left on a cafe table is a goldmine. Auto-lock within 1–2 minutes is best practice.

Malware, ransomware, and keyloggers can be installed through phishing links, dodgy downloads, or infected USB drives. AV software provides a catch-net for known threats.

Ransomware can encrypt everything on your device and demand payment. Hardware fails. Phones get dropped in toilets. A backup is your get-out-of-jail-free card.

An attacker on your network can intercept unencrypted traffic, see what sites you visit, and potentially access other devices. WPA3 is the modern standard.

Attackers set up "evil twin" hotspots with names like "CafeWifi_Free" to intercept your traffic. Even legitimate public networks carry risks from other users on the same network.

Routers sit at the gateway of your entire home network. Unpatched router vulnerabilities have been used in large-scale attacks affecting millions of homes.

IoT devices (smart bulbs, TVs, thermostats) often have weak security and rarely receive updates. If compromised, an attacker on the same network can try to reach your PC or NAS. Isolation limits the damage.

Your ISP's default DNS can log every site you visit and sell that data. Cloudflare 1.1.1.1 promises not to log queries and is significantly faster. NextDNS and AdGuard DNS can also block ads and trackers at the network level.

Modern phishing emails look incredibly convincing. Here are the tells:

Scammers call claiming to be from a trusted organisation, often saying you owe a fine, your account has been compromised, or your computer is sending viruses. They create urgency and ask for payment, remote access, or personal information.

Attackers use "OSINT" (open source intelligence) to gather info from your public profiles before targeting you. Your pet's name, mother's maiden name, and high school are all common security question answers — and common post topics.

Using one email everywhere means every breach exposes it for spam and credential stuffing. Aliases let you trace exactly which service leaked your data, and you can disable them instantly if they're compromised.

Every time you use "Sign in with Google/Facebook", you grant that app some level of access to your account. Many people have dozens of apps they no longer use that still have persistent access.

Apps routinely request far more permissions than they need. Location data, contact lists, and microphone access are valuable for advertising — and a privacy risk if the app is compromised or sold.

Your browser sees everything you do online. Chrome sends significant telemetry to Google. Brave blocks ads and trackers by default. Firefox has strong privacy extensions and a solid track record.

Without encryption, anyone with physical access can pull your hard drive and read every file — no password needed. With encryption, a stolen laptop is a useless brick to an attacker.

Identity thieves can use stolen personal information to apply for loans, credit cards, or even phone plans in your name. Early detection means early resolution.

HTTP sites transmit data in plain text. Anyone on the same network (especially public Wi-Fi) can intercept and read it. HTTPS encrypts the connection between you and the server.

Shodan.io (a search engine for internet-connected devices) indexes thousands of cameras and routers still running default credentials. Attackers use it to find and access these devices — including baby monitors and security cameras — remotely.

You can't be breached through an account that doesn't exist. Old forums, shopping sites, and apps hold personal data you've forgotten about. When those sites get breached, your data leaks.

Plain SMS is not encrypted in transit and can be intercepted. End-to-end encrypted apps like Signal mean only you and the recipient can read messages — not telecom companies, not governments, not the app maker.

Panic is the enemy. Having a clear plan means you act fast and correctly instead of making things worse.

New threats emerge, services change, and we gain new accounts. A 6-monthly review — ideally when changing clocks for daylight saving — keeps you ahead of the curve.