🎯31 daily security challenges for Cybersecurity Month. Start Playing
Cybersecurity Awareness Month 2026

Play the challenge. Level up your security.

Think like an attackerDefend like an admin

See this week's challenges
CostFreeFree to play, no sign-up
Time1–2 minPer challenge
PlayersEveryoneFor IT admins and every employee
AdminDroid bot on the Cybersecurity Awareness Month 2026 roadmap of security challenges

Get Breach-Ready with Us this October

31 days to play, share and learn your way ahead of attackers.

Play

Play. Learn. Repeat.

A new challenge every day this October. Spot the fake sign-in, stop the breach, keep your streak alive.

31 daily challenges · 2 min each
Play today's challenge
Share

Security on every wall.

Download, print and put them around your office.

Free download · no sign-up
Grab posters
Learn

Explore the 2022–2025 editions.

Four years of security series and guides for Microsoft 365 admins.

Open the archive

This Week's Operation

Pick a day, play the challenge, and see how you score.

October 2026
Challenges 0/31 0 Defense Rating

Upcoming Missions

A new mission unlocks every day. Each week opens a new phase.

Week 2

7 Challenges

Opens Oct 8

Week 3

7 Challenges

Opens Oct 15

Week 4

7 Challenges

Opens Oct 22

Week 5

3 Final Challenges

Opens Oct 29

Intelligence Archive

The threats evolve. So does the way we fight them.

Explore our cybersecurity awareness journey through the years.

2022

Oops, Missed Security Settings!

Essential Microsoft 365 security settings that admins often overlook, with simple steps to put them right.

Explore edition
2023

Beyond the Basics: The Zero-Trust Playbook

Strengthen your security model with advanced settings that add depth to everyday protection.

Explore edition
2024

Raise the Secure Score, Raise the Security

Practical guidance on Secure Score recommendations, and the essential protections the score doesn't cover.

Explore edition
2025

Secure Everything from AD to Cloud

Find and close security gaps across AD, Microsoft 365, and hybrid environments before attackers find them.

Explore edition

Think You Know Cybersecurity? Think Again.

Four things people still believe. Call each one: myth or fact?

Belief 1 of 4

“Client secrets are completely safe for apps.”

Myth
Fact

Client secrets can be leaked, extracted, or misused if stored insecurely, putting applications and data at risk.

Belief 2 of 4

“When a user is deleted, the AI agents they built stop too.”

Myth
Fact

Agents and app registrations keep running, now without an owner, and keep their access.

Belief 3 of 4

“Disabling an account doesn't end its active sessions.”

Myth
Fact

Existing tokens can stay valid. Revoke sessions as well as blocking sign-in.

Belief 4 of 4

“Break-glass accounts don't need MFA.”

Myth
Fact

Break-glass accounts are high-value targets, leaving them without MFA makes them even more vulnerable.

Bust more myths

From AdminDroid team · October 2026

Security is a team effort. Thanks for being part of it this month.

  • May every MFA prompt you see be one you started.
  • May your tokens never leave the device they were issued to.
  • May no hidden prompt ever talk your AI assistant into anything.
  • May no API key ever end up in a public repo.
  • May every QR code take you somewhere safe.
  • And may the only breach this month be a breach of bad habits.
— Team AdminDroid
Know Before You Play