Cybersecurity FAQ: 50 Questions About Online Safety

Security Education: This article describes cyber threats for defensive awareness and education purposes only. Understanding how attacks work helps organizations and individuals protect themselves. Never use this information for unauthorized access or malicious purposes.

These 50 questions cover the cybersecurity topics people ask about most often, from password basics to newer threats such as deepfakes. Each answer gives a direct, practical response, cites official guidance where it matters, and links to our detailed guides.

Passwords and Authentication

1. How long should my password be? At least 15 characters for any password you rely on by itself. NIST’s current digital identity guidelines (SP 800-63B-4) require a minimum of 15 characters for passwords used as a single authentication factor and say systems should allow at least 64 (NIST). Length matters more than complexity: a long passphrase of random words is both stronger and easier to remember than a short string of symbols. See our password strength guide.

2. Should I use a password manager? Yes. A password manager creates and stores a unique password for every account, which defeats credential stuffing, the attack that replays passwords leaked in one breach on other sites. See Best Password Managers 2026.

3. How often should I change my passwords? Only when there is a reason, such as a breach or signs of unauthorized access. NIST’s guidelines say services “SHALL NOT require subscribers to change passwords periodically,” but must force a change when there is evidence of compromise. If your passwords are unique, routine rotation adds little.

4. What is two-factor authentication? A sign-in method that requires two different kinds of proof, such as something you know (a password) and something you have (a phone or security key). It makes stolen passwords far less useful, but common forms can still be phished; see the next answer.

5. What is the most secure form of MFA? Phishing-resistant MFA: FIDO2 security keys and passkeys. CISA calls it “the gold standard” and notes that it is resistant to phishing, while push bombing, SS7 attacks and SIM swaps do not apply to it. SMS and voice codes are the weakest common option because they are vulnerable to phishing, SS7 interception and SIM swapping. CISA also stresses that any MFA is better than none (CISA). See our phishing-resistant MFA guide.

6. What are passkeys? Passkeys replace passwords with a cryptographic key pair based on FIDO standards. The private key stays with you, and the passkey works only on the website it was created for, which is why the FIDO Alliance describes the approach as phishing-resistant (FIDO Alliance). Passkeys can be stored in your device’s built-in credential manager (such as iCloud Keychain or Google Password Manager) or in a third-party password manager.

7. Is my browser’s built-in password manager safe? For most people, yes, and it is far better than reusing passwords. Built-in managers now include security checks: Google’s Password Checkup flags compromised passwords (Google), and Apple’s password tools flag weak or compromised passwords and support sharing. Dedicated managers add things like cross-browser and cross-platform use, richer sharing, and published third-party audits. Whichever you use, protect it with a strong device passcode and MFA.

8. What is a strong password? One that is long, unpredictable and unique. A passphrase of several random, unrelated words, or a long random string from a password manager, meets this standard. Avoid personal information, common phrases and keyboard patterns.

9. Can password managers be hacked? Yes, providers can be breached. In its December 2022 notice, LastPass said attackers had copied a backup of vault data containing unencrypted fields such as website URLs alongside encrypted usernames, passwords and notes, and that the encrypted fields depended on the strength of each user’s master password. A zero-knowledge design means the provider cannot read your vault, but you should still use a strong, unique master password and MFA.

10. Should I write down my master password? A written backup kept in a secure physical place (a home safe, for example), or your vendor’s emergency kit, protects against forgetting it. Do not keep it on a sticky note near your computer or in an unencrypted file.

Phishing and Social Engineering

11. What is phishing? A social engineering attack in which criminals impersonate trusted organizations or people to trick victims into revealing credentials or financial information, sending money, or installing malware. It is the crime type reported most often to the FBI: its Internet Crime Complaint Center (IC3) received 191,561 phishing and spoofing complaints in 2025 (IC3 2025 report). Full guide: Phishing Protection Guide 2026.

12. How do I recognize a phishing email? CISA’s warning signs include urgent or emotional language, requests for personal or financial information, untrusted shortened links, and slightly wrong email addresses or links (CISA). Check the real sender address, not just the display name, check links before opening them, and verify unusual requests through another channel. Our step-by-step guide: How to Recognize a Phishing Email.

13. What should I do if I clicked a phishing link? If you entered a password, change it immediately (and anywhere you reused it), sign out other sessions, and turn on MFA. Check for forwarding rules or recovery details you did not set. If you downloaded something, run a malware scan. Report the message. See our credential compromise checklist and identity theft protection guide.

14. Can phishing come through text messages? Yes. SMS phishing (smishing) uses texts with malicious links, often posing as delivery companies, banks, toll agencies or government offices. Treat unexpected texts with links like suspicious emails, and forward scam texts to 7726 (SPAM). See our smishing guide.

15. What is spear phishing? Targeted phishing aimed at specific people, using details gathered from social media, company websites or data breaches. Because it references real names and events, it is more convincing than mass phishing.

16. Can AI create phishing emails? Yes, and well. In a 2024 study by Heiding, Schneier and colleagues, fully AI-automated spear-phishing emails were clicked by 54% of recipients, the same rate as emails written by human experts, compared with 12% for a control group of generic phishing emails (Heiding et al.). CISA notes that poor grammar used to be a common sign but AI can now write error-free messages, so focus on the other warning signs.

17. What is business email compromise? An attack in which criminals compromise or impersonate a business email account to redirect payments, usually by wire transfer, or steal sensitive data. The IC3 recorded 24,768 BEC complaints with $3.05 billion in reported losses in 2025, second only to investment fraud. See our BEC guide.

18. How do I report phishing? Use your email provider’s built-in report option, which CISA recommends. The FTC advises forwarding phishing emails to reportphishing@apwg.org, forwarding scam texts to 7726, and reporting the attempt at ReportFraud.ftc.gov. If you lost money, also file a complaint with the FBI at ic3.gov. At work, use your organization’s report button.

19. Are QR codes used for phishing? Yes. QR code phishing (quishing) hides a malicious link in a QR code, in an email or on a sticker in a public place. Because the link is inside an image, it can slip past email link scanners that do not decode images, and it moves you onto your phone. Check the address your camera shows before opening it. See our quishing guide.

20. What is vishing? Voice phishing: calls or voicemails from scammers posing as tech support, a bank’s fraud team, government agencies or police, pressuring you to share information or pay. Hang up and call the organization back on a number you look up yourself. See our vishing guide.

Device and Network Security

21. Do I need antivirus software in 2026? You need malware protection, but you may already have it. Microsoft Defender Antivirus is built into Windows 10 and Windows 11 (Microsoft); keep it, or another reputable product, turned on and updated. Third-party security suites can add extras such as web filtering or identity monitoring. See Best Antivirus Software 2026.

22. Do I need a VPN? Not for basic safety on most networks. The FTC says that “because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe” (FTC). A VPN can add privacy from the local network or your internet provider, and protection on networks you do not trust, but it does not stop phishing. Our VPN Comparison 2026 covers the options.

23. Is public Wi-Fi dangerous? Less than it used to be, because most websites and apps now encrypt traffic. The bigger risk is a fake site: the FTC warns that scammers create encrypted fake websites, and encryption will not protect you from the people running the site. Check the address, avoid networks you do not recognize, and keep MFA and software updates on.

24. How do I secure my home Wi-Fi? Use WPA3 encryption (or WPA2 if WPA3 is not available), set a strong Wi-Fi password, change the router’s default admin password, keep the router’s firmware updated, turn off WPS, and consider a separate guest network for smart-home devices.

25. Should I keep my software updated? Yes. Updates fix security flaws that attackers actively exploit, often soon after a patch is released. Turn on automatic updates for your operating system, browser and apps.

26. What is ransomware? Malware that encrypts files and demands payment for the key, often while also threatening to leak stolen data. Common ways in include phishing emails, exploited software vulnerabilities and stolen passwords. Defenses include backups (see the 3-2-1 rule), prompt updates, MFA and malware protection.

27. What is the 3-2-1 backup rule? Keep 3 copies of your data, on 2 different types of storage, with 1 copy offsite (for example, in the cloud). Keep at least one copy disconnected or protected from changes, so ransomware cannot encrypt it too.

28. Are browser extensions safe? Many are, but extensions can read and change the pages you visit. Install only from official stores, check permissions and the publisher before installing, and remove extensions you no longer use. See our browser security guide.

29. How do I check if my data was in a breach? Enter your email address at haveibeenpwned.com, which checks it against known data breaches. If it appears, change the passwords for those services (and anywhere you reused them) and turn on MFA.

30. What is end-to-end encryption? Encryption in which only the sender and recipients can read a message, not the service in between. Signal and WhatsApp use it for messages by default. Proton Mail is end-to-end encrypted between Proton addresses, but mail to other providers is not end-to-end encrypted by default unless you use its password-protected email feature (Proton).

Privacy

31. How do I reduce my digital footprint? Share less on social media, review app permissions, use email aliases for sign-ups, consider a privacy-focused search engine, and request deletion from data brokers.

32. Do cookies track me? Third-party cookies can track you across websites for advertising. You can block them in your browser settings; Safari and Brave block third-party cookies by default, and Firefox isolates cookies for each site by default.

33. Is incognito mode private? Only on your own device. Private browsing stops the browser from saving your history and cookies after you close the window, but it does not hide your activity from your internet provider, your employer’s network or the websites you visit.

34. Should I use a privacy-focused browser? Browsers such as Firefox, Brave and Tor Browser offer stronger privacy defaults than some mainstream alternatives. The right choice depends on your needs and how much site compatibility you are willing to trade.

35. What data do apps collect? It varies widely, and some apps request more than they need. Review app permissions on your phone and revoke access to the camera, microphone, location and contacts for apps that do not need them.

Identity Protection

36. What is identity theft? The use of your personal information (such as your Social Security number, account numbers or medical information) to commit fraud. In the Bureau of Justice Statistics’ most recent survey, 76% of victims’ latest incident involved misuse of a single existing account, such as a credit card or bank account (BJS). Full guide: Identity Theft Protection Guide.

37. How do I freeze my credit? Contact each of the three bureaus: Equifax (equifax.com/personal/credit-report-services/credit-freeze), Experian (experian.com/freeze) and TransUnion (transunion.com/credit-freeze). The FTC confirms freezes are free to place and lift and do not affect your credit score (FTC). A freeze blocks most new credit in your name but does not protect accounts you already have.

38. What should I do if my identity is stolen? File a report at IdentityTheft.gov for a personalized recovery plan, freeze your credit, contact the companies where fraud occurred, and monitor your accounts. File a police report if a creditor or agency asks for one.

39. Are identity theft protection services worth it? They offer convenience: credit monitoring, dark web scanning and help with recovery. Most of the monitoring can be done free with credit freezes, bank alerts and free credit reports. If a service includes insurance, read what it covers and excludes before counting on it.

40. How do I check my credit report? Get free reports from Equifax, Experian and TransUnion through AnnualCreditReport.com, and look for accounts, addresses or inquiries you do not recognize.

Emerging Threats

41. What are deepfakes? AI-generated audio and video that imitate real people. Criminals use voice clones and fake video calls to impersonate executives, officials and relatives; in May 2025 the FBI warned that cloned voices “can sound nearly identical” to the real person (FBI). In the 2024 Arup case, an employee sent about US$25.6 million after a video call with deepfaked colleagues (CNN). A familiar voice or face is not proof of identity. See our deepfake phishing guide.

42. What is SIM swapping? An attack in which criminals persuade your mobile carrier to move your number to their SIM card, so they receive your calls and text-message codes. Protect yourself by setting a PIN or passcode with your carrier and using app-based MFA, passkeys or security keys instead of SMS where possible.

43. Are smart home devices secure? Many have weak security. Change default passwords, keep firmware updated, and put smart devices on a separate or guest network from your computers and phones.

44. What is a supply chain attack? An attack that compromises a trusted vendor, service or software update to reach that vendor’s customers. The SolarWinds compromise discovered in 2020 is a well-known example. Defenses include vetting vendors, verifying updates and limiting what third-party software can reach.

45. Can AI be used for cybersecurity defense? Yes. Security tools use machine learning to spot unusual email, sign-in and network behavior. AI is used on both sides: to generate phishing and to help detect it.

Practical Security

46. What is the single most important security step? If you do only one thing, stop reusing passwords: use a password manager and give every account a unique password, starting with email and banking. Then add MFA.

47. How do I secure my email account? Use a strong, unique password, turn on phishing-resistant MFA, review connected apps and devices, turn on login alerts, and check for forwarding rules you did not create. Your email is the recovery route for most other accounts.

48. Is it safe to use autofill for passwords and credit cards? Autofill from a reputable password manager or browser is generally fine. Password managers tie saved logins to a website’s domain, so autofill will not offer your password on a lookalike site. Treat that as a warning sign, not a guarantee: it cannot stop you from typing or pasting details into a fake page yourself.

49. What should I do after a data breach notification? Change the password for the affected service, and anywhere you reused it. Turn on MFA. Watch your financial accounts, and consider a credit freeze if sensitive information such as your Social Security number was exposed.

50. Where do I start if I have done nothing about security? Step 1: Install a password manager and replace reused passwords, starting with email and banking. Step 2: Turn on MFA for email and financial accounts, using passkeys where offered. Step 3: Work through the online security checklist. These three steps close the most common gaps.

Key Takeaways

• Unique passwords from a password manager, at least 15 characters if used alone, end the password reuse that credential stuffing exploits
• Phishing-resistant MFA (security keys, passkeys) is CISA’s “gold standard”; any MFA is better than none
• AI has made phishing harder to spot by its writing, so focus on what a message asks you to do and verify unusual requests
• Public Wi-Fi is usually safe thanks to encryption, according to the FTC; fake sites, not the network, are the main danger
• Start with the basics (password manager, MFA, updates, reporting) before buying advanced tools

Next Steps

• Start with the Phishing Protection Guide 2026 for the full defense strategy
• Protect credentials with Best Password Managers 2026
• Secure browsing with the VPN Comparison 2026
• Protect devices with Best Antivirus Software 2026
• Review the Identity Theft Protection Guide

Threats and best practices change; check the linked official guidance for updates.

Sources

1. NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management
2. CISA, Implementing Phishing-Resistant MFA (October 2022)
3. CISA Secure Our World: Recognize and Report Phishing
4. FIDO Alliance: Passkeys
5. FBI IC3, 2025 Internet Crime Report
6. Heiding et al., Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns (2024)
7. FTC: Are Public Wi-Fi Networks Safe? What You Need To Know (February 2023)
8. FTC: What To Know About Credit Freezes and Fraud Alerts
9. Microsoft Learn: Microsoft Defender Antivirus in Windows overview
10. Google Account Help: Change compromised passwords (Password Checkup)
11. Proton: Proton Mail encryption explained
12. FBI PSA: Senior US Officials Impersonated in Malicious Messaging Campaign (May 2025)