The holiday season (especially in Australia when the Ashes are on!) is a natural time for businesses to pause, but cyber risks and threat actors don’t take time off (perhaps they don't follow cricket?).
Being proactive and deliberate with your preparation for the slowdown period will minimise the opportunity for exploiting of vulnerabilities during this period when staffing is limited and operations slow down.
Holiday downtime changes how you face risk.
Doors and windows matter. So do passwords, firewalls and wifi!
To stay secure over summer, you need both physical and cyber hygiene working together.
When people leave the office, physical risks increase. Empty buildings attract break-ins, theft of devices, and tampering with networking gear or cabinets. At the same time, online threats spike, with more phishing, remote access attacks and account takeovers while IT teams run on skeleton staff.
Think of it this way:
Your holiday cyber hygiene plan should explicitly address both sides and how they interact.
Physical and online worlds meet at your devices, network equipment and shared spaces. If someone can walk into your site or access an unattended laptop, they may not need to “hack” your systems at all.
Key physical weaknesses that quickly turn into cyber incidents include:
We recommend starting your pre-holiday time with a full security audit, for both cyber and physical risks.
Microsolve’s existing cyber hygiene guidance on patching, backups, account clean‑up and remote access control becomes even stronger when paired with these physical basics.
We've made an easy Cyber Security Holiday Checklist that you can download and use when preparing your systems.
With staff taking leave, and peoples minds pre-occupied with more festive thoughts, the risk of overlooked alerts or unreported incidents increases. It's crucial to establish clear out-of-office communication plans, including updated contact lists for IT response teams who remain on duty. Share incident response protocols widely so employees know exactly how to report suspicious activity or emergencies during this time.
Implement multi-factor authentication to protect critical systems from unauthorised access. During this time, it's also highly recommended you restrict administrative privileges to a minimal number of trusted users to reduce insider risk. Consider deploying network monitoring tools that alert security teams to unusual activity automatically.
Regularly educate staff on holiday-specific cyber threats, such as phishing campaigns leveraging seasonal greetings, charity requests or fake delivery notifications. Reinforce the importance of vigilance, even when workload is light, so employees act as a strong line of defence against cyber threats.
Holiday posts can create physical and cyber openings at the same time. Publicly sharing that offices are closed or staff are overseas can signal opportunity to both thieves and cyber attackers.
Whilst it may be fun to post about your holiday plans, staff should be reminded to be weary of over-sharing online about office closures, travel plans or posting photos that reveal access badges, building layouts or any whiteboard content.
Other messages to tell your staff before the office closes, or they go on leave include:
Set social media expectations: encourage staff to keep travel details and office closure specifics private or shared only with trusted contacts.
Tidy out‑of‑office messages: keep replies simple, avoid listing full internal structures or supplier names, and direct unknown senders to a shared mailbox rather than individuals.
Reinforce phishing awareness: remind staff that attackers use holiday‑themed emails, fake delivery notices and charity requests to exploit the extra information they find online.
We know that many employees continue working remotely during holidays or access corporate resources from holiday destinations, which pose additional security challenges. Common risks include:
Using personal or shared devices for work without proper security, leaving business data on family computers or shared tablets.
Working in public places where others can see screens or “shoulder surf” credentials.
Leaving laptops or phones unattended in cafés, cars or hotel rooms, which can lead to both data theft and account compromise.
With this in mind, here are our top tips for best remote work practices over the holidays:
Standardise equipment: provide managed, encrypted devices for remote work and make it clear staff must not use family or shared devices for business access.
Protect the connection: require VPN for any access from outside your network, and discourage use of open public Wi‑Fi unless it’s secured with a trusted hotspot or VPN.
Control the workspace: remind staff to work where screens are not easily visible to others and to lock devices whenever they step away.
Travel guidance: publish a simple “working while travelling” checklist that covers carrying devices in hand luggage, hotel safe use and avoiding shared business centres.
Here are some further recommendations and tips:
Microsolve’s remote work tips on VPNs, endpoint protection, cloud collaboration tools and password managers align well with these physical controls and can be linked as your managed services option.
Different-sized organisations should approach physical–cyber integration in ways that match their capacity, while still aligning with Microsolve’s cyber hygiene checklist and managed services.
Aa an absolute minimum:
When multiple sites are in play, or your team have varied operational hours and responsibilities over the break:
When you have specific security/infrastructure compliance and regulation requirements the following need to be on your to-do list:
Align building access systems, visitor management and network access controls so physical badges, Wi‑Fi, VPN and application access all follow the same least‑privilege rules.
Use data from previous years such as incident logs, phishing reports and alarm activations to refine a standing “holiday hardening” plan for cyber hygiene and physical controls.
Microsolve can embed these steps into a broader cyber security roadmap, linking technical controls, staff training and facilities processes under a single, practical plan.
By treating cyber hygiene as an essential part of holiday preparation, businesses can safeguard their systems, data, and reputation during this high-risk period. Discipline in pre-holiday security steps, clear communication during staff absences, and vigilant remote work policies combine to create a resilient defense no matter where the season takes your team.