Cybersecurity Awareness Month needs a radical overhaul – it needs legislation

This commentary argues that Cybersecurity Awareness Month should move beyond repeating tips like strong passwords and MFA guidance and instead push for legislation that mandates secure defaults—particularly enabling MFA by default for services handling PII. Drawing parallels to GDPR and Apple’s MFA enforcement, it contends that regulation drives adoption and budgets for security, allowing public education to focus more on high-impact threats such as scams.