What Changed, What Stuck, and What I'd Do Differently

Not the highlight reel. The real one — me grading my own month, including the parts that didn't go the way I planned.

Thirty days ago I asked you to do something a little unreasonable: one security habit a day, every day, for a month. Today I want to do the thing I ask of everything on this blog — turn the lens around and give you the honest audit.

Here's the truth about 31 Days Safer: I wasn't just writing it. I was doing it, on my own accounts, same days as you. So this isn't a victory lap. It's what genuinely changed, what quietly didn't, what surprised me, and what I'd build differently if I ran it again. (Day 31, the final review, is still ahead — consider this the honest look-back before the capstone.)

What actually changed — in words, not a scoreboard

I thought about opening this with a stats dump: password-manager coverage, MFA percentages, a "network hygiene score." I decided against it, and the reason is itself a lesson from the month. A number makes a tidy graphic and tells you almost nothing about whether a habit held. I'd rather tell you what honestly shifted.

When I started 31 Days Safer, the goal was to make cybersecurity feel less overwhelming by breaking it into small, manageable actions. The challenge ended up turning the lens on my own habits too. The clearest example: I finally updated my home Wi-Fi network name — which hadn't changed since we moved in almost six years ago. A small thing, but it reminded me how easily we overlook what's already set up and quietly working.

It also reached past my own household. Some people told me they planned to make changes; others said they already had. That mattered, because the goal was never to publish 31 cybersecurity tips — it was to get people taking practical steps toward a safer digital life.

I can't measure every change that came out of this month. But I can point to something real: it got me to revisit my own habits, and it sparked actual conversations about the changes other people were making. The challenge wasn't just about teaching digital hygiene. It was about practicing it, too.

What stuck — and what quietly didn't

Now the honest part, because a wrap-up that's all wins is exactly the kind of tidy fiction I promised never to write.

What stuck

The biggest thing that stuck was the habit of looking at everyday digital activity through a security lens. Instead of treating cybersecurity as something that only matters when there's a breach or a suspicious message, I spent the month thinking about the small decisions we make constantly: what we click, what we share, which accounts we keep, and whether we're prepared to recover when something goes wrong.

The other habit that stuck was explaining the why behind each action. I never wanted 31 random security tips — I wanted people to understand what each habit actually protects them from. That approach is something I'm carrying straight into future DataSec Chronicles content.

What quietly didn't

Here's the honest one. "One cybersecurity lesson a day" sounded manageable when I planned it. But each lesson became much more than one post — graphics to make, captions to write, platforms to adapt for, details to check. Some days the challenge felt less like a ten-minute digital hygiene activity and more like a full content production schedule.

I also spent so much time creating the daily lessons that I didn't consistently promote the free downloadable challenge itself. The resource was right there — I just could have done a lot more to help people find it.

The biggest lesson underneath both: consistency doesn't automatically mean sustainability. I could hold the daily pace for 31 days. That doesn't mean it's a pace I should keep indefinitely — and pretending otherwise would be its own kind of unsafe habit.

I'm telling you the misses on purpose, because a challenge that only reports its wins is just pressure dressed as help. The goal was never 31 perfect days. It was not safer than you started — and by that bar, even the rough days taught me something.

What surprised me

What surprised me most was the engagement. I knew I could share the information — I didn't know how people would respond. Throughout the month, people kept commenting that they were going to make a change, or that they already had.

That meant something to me. It's one thing to publish a security tip. It's another to hear someone say they're actually going to use it.

As a data analyst, I live in numbers — engagement, impressions, performance. But those conversations reminded me that the impact of educational content isn't always captured by likes. Sometimes it's one person deciding to review their privacy settings, secure an account, or rethink an everyday habit. That was exactly what I hoped this would spark.

What I'd do differently in a v2

No project survives contact with reality unchanged, and running this in public showed me its seams. If I built 31 Days Safer v2, I wouldn't add more content — I'd make the experience easier to follow and to sustain, mine and yours:

• Build it before launch. I'd prepare far more of the graphics and captions ahead of time, instead of producing so much of it live during the month. The production load was the real cost.

  
  

• Build promotion into the schedule from day one. Creating a free resource is only half the job — people also need chances to discover it, especially anyone joining halfway through. That's on me to plan next time, not improvise.

  
  

• Add weekly check-ins — a built-in moment to reflect on what you completed, what was hard, and which habits you actually want to keep. (The Saturday recaps hinted at how much people wanted this.)

  
  

• Keep emphasizing flexibility. Digital hygiene shouldn't feel like one more overwhelming checklist. Missing a day isn't failing. The point is progress and habits that outlast October.

  
  

I wouldn't want v2 to be bigger for the sake of bigger. I'd want it more sustainable, more interactive, and easier for people to make their own — probably as a proper website rather than a month of posts. That's the real product note from running v1 in public: you don't learn where a thing bends until you ship it and watch.

To everyone who followed along

Whether you did all 31 days, a handful, or just read along and nodded — thank you. Genuinely. Doing this in the open, with people actually trying the tasks and telling me what landed, is what turned a list of tips into something that felt alive. The questions you asked (how does UPnP work? Wait, SIM-swapping is real?) made the whole thing better, and some of them are going straight into v2.

If you're just finding this now, you haven't missed anything. The whole challenge is evergreen — every day stands alone, and "start today" is always a valid answer.

Everything, in one place

Since this is the natural spot to gather it all:

• The free 31 Days Safer tracker — all 31 days laid out, yours to work through at your own pace, no cost. Grab it here.

  
  

• The rest of the DataSec Chronicles toolkit — for anyone who caught the bug and wants to go further, a small storefront of security workbooks, quick-reference sheets, and starter kits at datasecchronicles.gumroad.com. The free tracker lives there too, so it's one stop.

  
  

No pressure on the paid stuff — the challenge was always free and always will be. But if the month made you want to keep building the habit, those are the next rungs.

How I'd explain this in a SOC interview

Ask me about running a security initiative and measuring whether it worked, and this month is the honest answer. I didn't grade it on a vanity metric — "31 days completed!" — because completion isn't the outcome that matters; behavior change that persists is. So I audited it the way you'd review any control after deployment: what actually changed, what held over time versus what reverted, what the users (including me) quietly didn't adopt and why, and what the next iteration needs. A security program that only reports its wins is a program lying to itself. The useful version tracks what didn't stick, because that's where the real risk still lives. Same instinct, bigger console: the honest after-action is worth more than the triumphant one.

So that's 31 days, told straight. The walls are up, the habits are started, and the one thing I most want you to take from the month is this: you don't have to be perfectly secure. You have to be harder to hit than you were in September — and if even a few of these days stuck, you are.

Day 31 — the final review — is the capstone, and I'll see you there to close it out.

Storm to SOC — read the map, then move. 💜