Week 1 Recap: How Did Identity Week Go?
One week into 31 Days Safer. Seven days down. Let's take a breath and check in.
Saturdays are the flex days — no new task, just a look back at the week we closed and a chance to catch anyone up who's jumping in late. Week 1 was Anchoring Your Identity: the breach check, a real password manager, breaking the reuse habit, locking down your email as the master key, strengthening MFA, hardening your social profiles, and securing your recovery codes.
That's a lot for seven days. So first — if you did even half of it, you're meaningfully harder to hack than you were last Sunday. That's not a participation trophy. That's the actual point.
How the week landed
Better than I expected for week one, honestly. A few of the days got retweeted around, which is always the quiet signal that something landed — people don't reshare a chore, they reshare a thing they want their own circle to see.
The comment that stuck with me came on Day 4 — Lock Down Your Digital Master Key:
"Exactly. I recently realised that one of my emails was compromised… never used it again."
— a reader, on Day 4
That's the whole challenge in one sentence. Not a hypothetical, not a scary stat — a real person who'd lived the exact thing Day 4 is built to prevent, nodding along because they already knew the cost. Your email is the master key that resets everything else, and the people who've learned that the hard way don't need convincing.
The day that sparked the most
No contest: Day 5 — MFA — and specifically SIM-swapping. About three of my mutuals told me, in different words, the same thing: they had no idea this was possible. That your phone number could be lifted off your SIM by someone sweet-talking a carrier rep, and that the text codes you've been trusting as your "secure" second factor would just start landing on an attacker's phone.
That reaction is exactly why this challenge pairs every habit with the threat behind it. "Turn on MFA" is a chore. "Here's how someone steals the text version out from under you" is a reason. The moment it clicked for those three, Day 5 stopped being a to-do and became a decision.
If that's you too — if SIM-swapping was news — yesterday's Friday deep dive is the full walkthrough: how the attack works, where SS7 fits (honestly, not the hyped version), and exactly which authenticator app to switch to. Go read Why SMS-Based 2FA Is Not Enough, and then go move your email off SMS. That's the single highest-value thing you can do this weekend.
My own honest take
I'll hold myself to the same standard I hold everyone else: did I actually do the work, or just write about it?
I did it. Clean run through Days 1–7 on my own accounts — the breach check, the vault, the email lockdown, MFA on the critical accounts, recovery codes stored somewhere separate from my phone. No shortcuts, no "I already had that handled so I skipped it."
The real lesson hit me in two parts.
First: security isn't only about keeping people out — it's about making sure you can get back in. Days 1 through 7 aren't all locks. The breach check, the recovery codes, the email lockdown — half of Week 1 is really about recoverability, about not getting shut out of your own life when something goes wrong. I'd been thinking of "security" as walls. This week reminded me it's walls and doors you can still open.
Second, and this is the one I'll carry: I don't have to fix everything at once to make meaningful progress. Setting up or updating even one thing keeps criminals out and keeps me in. The whole challenge is built on that — one small habit a day, not a weekend of panic. You don't have to clear all seven days to be safer than you were. One does it.
That's the whole reason I build these in public — if I'm asking you to do it, I'm doing it alongside you, same days, same friction, same lessons.
Jumping in late? Totally fine
This isn't a train you miss. If you're just finding the challenge, start at Day 1 today — the whole point of Week 1 is that it's the foundation everything else sits on. The free tracker has all 31 days laid out, so you can move at your own pace. There's no late.
What's next
Week 2 is Fortifying the Castle — your home network. Router dashboards, replacing factory passwords, Wi-Fi security, keeping your smart devices from talking to your real ones. It's the week people skip because routers feel intimidating, and it's exactly the week that quietly matters most. We start Monday.
So: tell me how your Week 1 went. What stuck, what you skipped, what question you're sitting on. Drop it in the replies — that's what these Saturdays are for.
Storm to SOC — read the map, then move. 💜
Comments