6 Small Security Habits That Make a Big Difference

Most security advice arrives as an overwhelming list. Use unique passwords everywhere. Enable two-factor authentication. Keep your software updated. Check your privacy settings. Monitor your accounts. Back everything up. It's not wrong — but presented all at once, it's paralysing, and paralysed advice gets ignored.

So here's a different approach: six habits, ordered by how much protection they give you relative to how much effort they take. More importantly, each one comes with the context you actually need to understand what it does and why it works — not just a checkbox to tick.

The six habits

Habit 01 — Use a password manager — and let it do the work

A study of 19 billion leaked passwords found that 94% were reused or duplicated across services. The average person reuses the same password 14 times. This is the root cause of most account takeovers — not sophisticated hacking, but the mechanical testing of known credentials against every other service the victim uses. It's called credential stuffing, and it's automated, continuous, and extraordinarily effective.

A password manager generates a unique, random password for every account and fills it in automatically when you log in. You remember one password: the master password that opens your vault. When a service you use is breached, that breach exposes credentials that work nowhere else. Your passwords are encrypted on your device before they reach the manager's servers. The free options are genuinely excellent: Bitwarden gives you unlimited passwords across unlimited devices at no cost, with full encryption and independent security audits.

Habit 02 — Turn on two-factor authentication — and use an app, not SMS

Two-factor authentication (2FA) adds a second verification step beyond your password — typically a six-digit code that changes every 30 seconds. Studies suggest that 80% of account breaches could have been prevented if the victim had 2FA enabled. Even if an attacker has your exact password, they can't get in without that second factor.

There's a meaningful difference between 2FA methods. SMS-based 2FA is significantly weaker than app-based 2FA due to SIM swapping: an attacker calls your mobile carrier, impersonates you, and convinces them to transfer your phone number. In 2024, the FBI recorded nearly $26 million in losses from SIM-swap attacks in the US alone. An authenticator app generates codes locally on your device without touching the mobile network at all.

Our recommendation is Authy over Google Authenticator: Authy keeps an encrypted backup of your 2FA accounts and syncs across multiple devices. Google Authenticator has historically been a single point of failure — lose your phone without a backup and you're locked out of every account using it.

Habit 03 — Keep your devices and apps updated — automatically

Software updates exist for two reasons: new features, and security patches. When researchers or attackers discover a vulnerability in an operating system or application, the developer fixes it and releases an update. Until you install that update, your device is running with a known weakness — and attackers actively scan for unpatched systems.

The time between a vulnerability being discovered and it being actively exploited has compressed dramatically. Today, critical vulnerabilities are often exploited within 24 to 72 hours of public disclosure. Automatic updates remove the decision entirely — your device installs security patches in the background, usually overnight, without requiring any action from you.

Habit 04 — Pause before you click — especially when something feels urgent

Phishing — emails, texts, and calls impersonating trusted organisations — is responsible for the majority of account takeovers. The technique works not because people are careless, but because it exploits a specific cognitive bias: urgency short-circuits careful reasoning. When we feel time pressure, we shift from deliberate thinking to fast-response thinking. Phishing attacks are engineered to trigger exactly that shift.

The defence is a deliberate pause. When something unexpected arrives asking you to click a link or enter credentials: stop. Check the actual sender domain, not the display name. Go directly to the organisation's website by typing it yourself rather than following any link. If the issue is real, you'll see it there. That pause — even just ten seconds — breaks the urgency mechanism the attack depends on.

Habit 05 — Review what your apps can access — and revoke what they don't need

App permissions accumulate quietly over years. Most people grant permissions at installation without reading them and never revisit them. On a phone with several years of installed apps, the permission landscape can be remarkably broad.

This matters for two reasons. First, permissions represent genuine access — an app with microphone permission can record audio when running. Second, many apps share permission-derived data with analytics partners, advertising networks, and data brokers. A useful rule of thumb: an app should only have access to capabilities its core function requires. A calculator has no legitimate reason to access your contacts. A flashlight has no legitimate reason to access your location.

Habit 06 — Back up the things that would be hardest to lose

Ransomware encrypts your files and demands payment for the decryption key. Hardware failure destroys data without warning. A lost or stolen device takes with it everything not stored elsewhere. In each scenario, the difference between a recoverable incident and a genuine loss is whether your data exists somewhere other than the affected device.

The 3-2-1 backup rule is the practical standard: three copies of important data, on two different types of storage, with one copy stored somewhere physically separate. In practice for most people, this means cloud backup for your phone and either cloud storage or an external drive for your computer — with the external drive stored somewhere other than next to the computer.

How these six habits stack up

The pattern is consistent: the highest-protection habits are the ones you set up once and rarely touch again. Password managers, automatic updates, and cloud backup all provide sustained, compounding protection for minimal ongoing effort. The only habit on this list that requires active attention is the phishing pause — and even that becomes instinctive with practice.

You don't need to do all of this at once. Pick the first one, do it today, and come back for the next. A year from now, all six running together will have made a measurable difference to your daily digital security posture.