Clean water

Matthew Grimes

It's October, which means it's Cybersecurity Awareness Month. This year's theme is "Don't Make It Easy for Them." The advice is four familiar habits: use strong passwords and a password manager, turn on multi-factor authentication, learn to spot scams, and keep your software updated.

It's good advice. I follow it, and you should too. But notice who it's aimed at. It's aimed at you.

Imagine a Clean Water Awareness Month. Every October, families would be reminded to boil their water, inspect their pipes and learn the early signs of cholera. We'd find that absurd, because we decided long ago that safe water isn't each family's job. It's built into the system before it reaches the tap.

Online safety is still mostly treated like a personal chore. I think that's about to change, and it should. Basic cybersecurity is on its way to becoming what clean water became: something every person can count on, whether or not they understand how it works.

Your problem

Right now, staying safe online is your problem. And it's going badly, through no fault of most people.

Americans reported a record $20.9 billion in internet crime losses to the FBI last year, across more than a million complaints. People over 60 alone reported about $7.7 billion, up 37%. In the first half of this year, the Identity Theft Resource Center counted 471 million data breach notices sent to victims. That's more than in all of 2025, in just six months.

Data breach victim notices, 2025 vs. first half of 2026

Source: Identity Theft Resource Center, Jul 2026

297.5M

471.2M

All of 2025

First half of 2026

So whose fault is all this? Mostly nobody's in particular, and that's the problem. Most of those notices went to people who did nothing wrong. A company they trusted with their data got breached. The center's president put it plainly: "Consumers can take all of the right steps, businesses can have the best cybersecurity and still fall victim to criminals."

Even the personal habits are hard to keep. In a survey of more than 5,000 people across five countries, 77% recognized multi-factor authentication. Only 41% used it regularly. That's not stupidity. It's what happens when you ask every person to be their own security team.

In 2011, the security researcher Wendy Nather coined a phrase for organizations that can't afford basic protection: the security poverty line. It applies to people too. Free security updates for Windows 10 were due to end this week, before Microsoft extended them to October 2027. For millions of people, whether their computer stays safe came down to a company's decision they had no say in. The person with an older laptop or a cheap phone is the one most likely to fall below the line.

People who know about MFA vs. people who use it

Source: National Cybersecurity Alliance and CybSafe, 2025

77%

Recognize it

41%

Use it regularly

From privilege to right

We've been here before, with something even more basic.

In 1854, the physician John Snow traced a London cholera outbreak to a single water pump on Broad Street. At the time, safe water was a privilege. If you could afford a better source, you were safer. If you couldn't, you took your chances.

The fix wasn't teaching every family to test its water. In 1908, Jersey City became the first US city to disinfect its drinking water routinely, and thousands of towns followed within about a decade. US typhoid cases fell from roughly 100 per 100,000 people in 1900 to 33.8 by 1920, and to about 0.1 by 2006. The CDC counts water treatment among the greatest public health achievements of the 20th century.

US typhoid cases per 100,000 people

Source: CDC

~100

1900

33.8

1920

~0.1

2006

Then the idea went further. In 2010, the UN General Assembly recognized safe and clean drinking water as a human right, by a vote of 122 to 0.

Privilege, then public utility, then right. That's the path clean water took. It happened because water stopped being optional. Nobody can live without it, so nobody should have to earn it.

The internet has quietly crossed the same line. Your bank, your doctor, your child's school and your government services all live online now. You can't opt out of it any more than you can opt out of water. It took a century and a half. Cybersecurity is moving along the same path, much faster.

What a right looks like online

A right to basic cybersecurity doesn't mean a government agency guarding your phone. It means the protection is built in upstream, before anything reaches you, the way chlorine is added at the plant and not in your kitchen.

Parts of that already exist.

The first piece is that the things you buy come safe. Since April 2024, the UK has banned universal default passwords on connected consumer devices. Makers must also tell you how to report a flaw and how long the product will get security updates. From December 2027, the EU's Cyber Resilience Act will require most products with software in them to get security updates for a set support period. That period is generally at least five years. Buying a smart camera shouldn't be a gamble.

The second is sign-in that can't be phished. About 5 billion passkeys are now in use. A passkey has no password to steal and nothing a scammer can talk you out of, and you never have to remember it.

The third is that the people who make software own the risk. More than 180 companies have signed the US government's Secure by Design pledge. They committed to more multi-factor authentication and fewer default passwords. Fixing a flaw at the factory protects every customer at once.

The fourth is enforcement. Last week, the FBI announced it had helped take down a scam compound in Ghana that targeted Americans, mostly older people. More than 130 people were detained. A right needs someone whose job is protecting it.

AI cuts both ways here. Scammers already use it, and the FBI counted nearly $893 million in AI-related losses last year. But the same technology can do the defensive reading that used to need trained people, at a scale that could reach everyone. The open question is whether it gets built into the systems we all use, or sold only to those who can pay for it.

Over this series, I've written about trade, insurers, AI labs and deepfakes. This one is about the person at the end of all of them. Every record, every policy and every proof in those essays exists so that an ordinary person can trust what happens to them online.

What I'm not saying

I'm not saying personal habits don't matter. Clean water still depends on you not drinking from the river. Turn on multi-factor authentication. Use a password manager. Update your phone.

I'm not saying this is settled law. Nobody has declared cybersecurity a human right, and the rules above are a patchwork across countries.

And I run a security company, so I have an interest in people taking security seriously. My point here is that the basics shouldn't depend on what you can afford or how much you know.

What would change my mind: if awareness campaigns alone started bringing losses down. Losses just hit a record, after more than two decades of Cybersecurity Awareness Months.

What kind of world?

There's a world where online safety stays a personal skill. People who are careful, technical or wealthy do fine. Everyone else, including the 80-year-old with an old phone and the teenager on a cheap device, absorbs the losses. Each October, we remind them to try harder.

There's another world, where basic security is part of the plumbing. Devices ship safe, sign-in can't be phished, makers answer for their flaws, and someone enforces the rules. In that world, you're protected by default, and the advice is a bonus, not a lifeline.

Nobody in Jersey City had to understand chlorine to drink clean water. You shouldn't have to understand cybersecurity to be safe online.

Thanks for reading,
Matthew