In August half the workforce is away, committees space out and approvals take longer. What does not slow down are the systems. Email keeps receiving, integrations keep running and remote access keeps listening. That asymmetry, an organisation at half speed and technology at full speed, is exactly what an attacker needs.

Why does August raise the risk?

It is worth saying without drama. The summer advantage is not technical. August attacks are no more sophisticated than March ones. What changes is reaction time. Whoever would have spotted the odd movement is on holiday, the decision to isolate a system waits for somebody to answer the phone, and the supplier providing support is running on a skeleton crew too. Whoever gets into a system in August has something that is scarce the rest of the year, whole days with nobody watching.

The backdrop gives no respite. Incidents handled by national response bodies grow year after year and online fraud is the category climbing fastest. The curve always rises. The only thing that drops in August is the capacity to respond to it.

August does not bring more sophisticated attacks. It brings more time with nobody watching.

What should internal audit check before August?

For an internal audit team this is not a seasonal anecdote. It is an exposure window that repeats every year on the same dates, that nobody owns, and that can be reviewed before it arrives. Four checks fit in one morning and leave evidence for the file.

  1. A named on-call. If something fires on 15 August, who gets called. A person, a backup and their channels, with the date of the last time the escalation was tested. Without this, everything else arrives late.
  2. Second factor on email and remote access. Email is the door almost every deception comes through, and in summer it is read on a phone in a hurry. The test is real coverage across the population, not the policy.
  3. Accounts of people who have left. June and July leavers are the August classic. Cross the quarter's leavers against live access, including supplier and service accounts.
  4. Minimum remote access for the period. Whatever nobody will use, switched off, and the supplier's standing access turned into access on request. That is the difference between a closed door and one left ajar.

What does this review cost?

None of them needs budget. They need half a morning and knowing who can get in, which is a governance question and not an IT one. If it turns out that list does not exist for the full population, that is the real summer finding, and the access lifecycle is where it gets sorted, as explained in joiners, leavers and recertification.