What is cyber hygiene?

Why it matters more than advanced defenses

Almost every incident that reaches a real person starts somewhere ordinary: a password reused from a breached site, a laptop two updates behind, a message that looked like it came from a colleague. Attackers prefer the cheap path. Cyber hygiene closes those cheap paths, which is why university and enterprise security programs teach it first — long before anyone talks about threat hunting or zero trust architecture.

Cyber hygiene vs. digital hygiene

The two terms are often used interchangeably, and the habits overlap almost completely. The useful distinction is one of scope.

Wondering whether to drop passwords entirely? See passkeys vs. passwords.

Put simply: cyber hygiene is the security half of digital hygiene. If you are looking for “security fundamentals,” you want cyber hygiene. If you also care about how much of you is discoverable online, you want the wider practice — which is what Hygi. teaches.

The eight core cyber hygiene practices

• Use a password manager and unique passwords

  Reused passwords turn one breach into many. A manager generates and remembers a long, unique password for every account so you only memorize one.

• Turn on multi-factor authentication

  An app-based code or passkey stops most account takeovers even when your password leaks. Prioritize email, banking, and work accounts first.

• Patch quickly and automatically

  Most successful attacks exploit a bug that already had a fix. Enable automatic updates for your operating system, browser, and apps.

• Slow down on links and attachments

  Phishing — increasingly written with AI — is still the most common way in. Verify unexpected requests through a channel you already trust.

• Encrypt devices and lock screens

  Full-disk encryption plus a strong passcode means a lost laptop or phone is an inconvenience, not a data breach.

• Back up on a schedule and test restores

  Keep one backup offline or versioned. Ransomware only wins when the only copy of your data is the one it encrypted.

• Shrink what you expose

  Audit old accounts, tighten social privacy settings, and remove data you no longer need. Less exposure means less to protect.

• Know how to report a problem

  Decide in advance who you tell and how fast. Reporting early limits damage far more than trying to fix it quietly.

A cyber hygiene checklist you can finish this week

1. Install a password manager and move your email password into it first.
2. Turn on multi-factor authentication for email, banking, and work accounts.
3. Enable automatic updates on every device you own.
4. Confirm disk encryption and a screen lock on your laptop and phone.
5. Set up one automatic backup, then restore a single file to prove it works.
6. Delete or lock down five accounts you no longer use.
7. Write down who you would report a suspected compromise to, and how.

Case study: turning the Dartmouth digital hygiene guide into measurable lessons

Hygi. began as a straight adaptation of Dartmouth College’s digital hygiene guidance. Each guide topic became a five-minute lesson with a mini-quiz, so learning could be measured rather than assumed. The figures below describe this curriculum as published — they are counts of what we built from the guide, not outcome claims made by Dartmouth.

Guide topics turned into lessons

7

Expanded to 22 lessons with other university and CISA sources.

Quiz questions on those lessons

26

Every lesson ends in a mini-quiz before its badge unlocks.

Concrete action steps

76

Each step is something a learner can finish the same day.

Badge pass requirement

100%

A badge is only awarded on a perfect mini-quiz, so it signals comprehension.

How outcomes are measured

• Comprehension. Every lesson ends in a mini-quiz; a badge is awarded only when all questions are answered correctly, so a badge is evidence of comprehension rather than time spent.
• Misconception tracking. Missed questions are counted anonymously and only with consent, which shows which habits need clearer explanation.
• Vocabulary support. Jargon is linked to a plain-language glossary, and tapped terms are counted anonymously to reveal where wording is still too technical.
• Completion. Finishing every lesson earns a trophy, giving a single end-to-end completion signal per learner.

Frequently asked questions

What is cyber hygiene?

Cyber hygiene is the routine set of security habits — unique passwords, multi-factor authentication, prompt updates, careful clicking, encryption, and backups — that people and organizations repeat to reduce the chance of a breach. Like brushing your teeth, the value comes from consistency rather than any single action.

What is the difference between cyber hygiene and digital hygiene?

Cyber hygiene focuses on security: keeping attackers out of your accounts, devices, and data. Digital hygiene is broader and also covers privacy, your online footprint, and how tidy and intentional your digital life is. In practice they overlap heavily — good cyber hygiene is the security half of good digital hygiene.

Why is cyber hygiene important?

The overwhelming majority of incidents start with an ordinary, preventable gap: a reused password, an unpatched device, a convincing phishing email. Basic hygiene removes the cheap paths in, which is why security teams at universities and companies teach it before anything advanced.

How often should I review my cyber hygiene?

Automate what you can — updates, backups, and password generation — then do a fifteen-minute review each quarter: check for breached passwords, remove unused accounts and app permissions, and confirm your backups actually restore.

Where do I start if I have never thought about it?

Start with a password manager and multi-factor authentication on your email account, because email resets everything else. Then work through the rest one habit at a time — Hygi. turns each of them into a short lesson with a quiz and a badge.