How exposed are you? Score it.

Some of your passwords are already in criminal hands; what matters is whether a stolen one gets an attacker anything. Unique passwords in a manager plus a hardware key or passkey on email and money accounts make the answer no. The steps are Bitwarden's; any manager meeting the Chapter 2 criteria works the same way.

Social engineering was always the cheapest attack; AI made it the best one. The tells you were taught — bad grammar, a voice that sounds off — are gone. Language models write flawless, personalized email; a few seconds of audio clones a voice that passes a phone call; real-time video replacement runs on consumer hardware. What remains is structure: urgency, secrecy, authority, and a change in where money, codes, or access go. Any two together is an attack until verified. The defense is a habit, and the procedures below install it.

The home is an office, a school, and a social venue on one network, and the attacker needs only the weakest of the three. Separate the network, separate the devices, and give every person a rule they can follow without you. Router menus differ by brand; the settings below exist on every current router — use the search box in the router's app or admin page if a name differs.

Fraud is a conversation, not a hack. Wire and closing fraud, investment and 'pig-butchering' schemes, romance, grandparent, government-impersonation, tech-support, invoice, and payroll-diversion fraud all end the same way: you send money to a destination you did not verify. Fix the last step and the story does not matter. The procedures below put the controls in place; Chapter 4 covers recognizing the approach.

Travel removes every protection that depends on being home and adds hostile networks, physical loss, border inspection, and a public announcement that the house is empty. Carry less, encrypt everything, connect through your own hotspot or VPN, and post about the trip after you are back. Run the three procedures in order: before, during, after.

Email is the master key: every other account resets through it. Harden every account you own in the same order — strongest sign-in, recovery you control, sessions and apps you recognize, no forwarding you did not create. Paths are as each provider's help pages stated them in September 2026; menus move, so search the settings page for the term if a step has changed. Do 8.1 once, then the section for each provider you use.

Your phone is your second factor, your wallet, and your password vault. Settings track the operating-system version, not the model, so this chapter is organized by platform. First rule: run the current OS with automatic updates. Second: retire any device that no longer receives security updates from anything touching money or email; no setting below can save an unpatched phone.

Social media is where attackers do their research and where they impersonate you afterward. Your posts supply security-question answers, voice and video for cloning, travel dates, and the names of your children and your assistant; the account itself, once taken, is used to defraud everyone who trusts you. Lock it like a bank account and post like an intelligence officer: assume the adversary is reading.

Your router is not a firewall. A consumer-grade edge device — Firewalla at home, a Ubiquiti UniFi gateway in the office — catches the basics: known-bad destinations, DNS filtering, segmentation, tracker blocking. What turns it into a defense is the rest of the stack behind it and someone watching.

Most household compromises still start on a laptop: a download, a browser extension, a saved password, an administrator account used for email. The controls are the same on Windows and Mac — automatic updates, a standard account for daily use, full-disk encryption, real endpoint protection, a hardened browser, and a screen that locks. I put every computer I am responsible for under NinjaOne with SentinelOne, because those two things together make this chapter automatic: patches, protection, and backups happen without anyone remembering, and as a virtual CISO I can look at any machine remotely and know it is handled — the automation is the point, not a person watching. If you are doing it yourself, the steps below get you most of the way.

Ransomware works because backups fail: they are connected when the encryption runs, they were never tested, or they do not exist. The rule is 3-2-1 — three copies, on two kinds of media, one of them off-site and either offline or immutable (cannot be altered or deleted for a set period even by you). A phone backup and a laptop's cloud sync are not that. In the reference stack, NinjaOne runs the backups so that the copy exists, is versioned, and is restore-tested without anyone remembering; the steps below do the same by hand.

The preface described how an attacker starts: not at your firewall but at Spokeo. People-search sites, data brokers, public records, and your own social media supply the address, the phone number, the relatives, the neighbors, the car, the mortgage, and the security-question answers — assembled in minutes, now by an agent. You cannot erase yourself. You can make the dossier thin, stale, and expensive to build, which is what sends an automated attacker to the next name. This is the work Gingerbread does continuously for Monadnock Cyber clients; the steps below are the manual version, and they are worth doing once even if you then hand it off.

A small business is attacked the same way a household is — through a person, a password, a payment, or a patch — with two differences: the attacker's payoff is larger, and the business has obligations a family does not (customers, regulators, an insurer, employees who can be fooled). The eight procedures below are the defensible minimum for a firm with no security staff. They are also, not by coincidence, most of what a cyber insurer now asks you to attest to. This is the checklist I run for my own office, and the one a Monadnock Cyber virtual CISO runs with a client.