Key Takeaways
- Most phishing gets through on trust, not technical trickery. Train staff to question urgency, not just spot bad spelling.
- DMARC, SPF, and DKIM stop attackers from spoofing your domain in the first place.
- Multi-factor authentication is the single biggest thing you can do to stop a stolen password becoming a breach.
- Simulated phishing tests work best when they teach, not catch people out.
- A written incident response plan means people know what to do in the first ten minutes, not after the panic settles.
Why phishing still works
Phishing does not succeed because people are careless. It succeeds because attackers have gotten good at mimicking the normal texture of business communication. A phishing attack today often looks exactly like an invoice, a delivery notice, or a message from a colleague, built from details an attacker pulled off LinkedIn or a company website.
Business email compromise takes this further. Instead of a mass email, it is a targeted message impersonating your CEO or a known supplier, usually asking for an urgent payment or a change to bank details. These do not trip spam filters because there is no malware attached. It is just a well-written lie.
What to actually look for
Most phishing relies on a handful of tricks: a spoofed sender address, a link that goes somewhere slightly different to what it displays, or an attachment that asks you to enable macros. Microsoft’s guidance on phishing is a good starting point. The simplest rule holds up well: an unexpected request for a password, a payment, or sensitive data is worth a second look, no matter how convincing it seems.
What a breach actually costs
The invoice for a phishing breach rarely stops at the ransom or the fraudulent transfer. Notification obligations, client trust, and regulator attention all add up long after the initial incident is contained. That is the real argument for spending on prevention before an incident, not after.
Spotting business email compromise
Watch for last-minute changes to payment details, a slightly altered sender address, or pressure to bypass normal approval steps. A short, mandatory callback to a known number before any bank detail change is one of the cheapest controls available and it stops most BEC attempts cold.
Email security that actually works
Gateway-level filtering catches the bulk of phishing before it reaches an inbox, using threat intelligence that updates continuously against known malicious domains and patterns. This takes the decision away from staff for the obvious cases, so training time goes to the ones that get through.
Securing Microsoft 365
Cloud email needs configuration beyond the defaults. Behavioural monitoring for unusual sign-ins or unexpected mail forwarding rules catches account compromise early, often before an attacker has done anything visible.
| Security layer | What it does | What it stops |
|---|---|---|
| Email filtering | Reputation and pattern scanning | Spam and bulk phishing |
| Behavioural analysis | Anomaly detection | Compromised accounts and unusual sender behaviour |
| Multi-factor authentication | A second proof of identity | Unauthorised access, even with a stolen password |
Quarantine and sandboxing
Suspicious attachments should open in an isolated environment first, not the user’s machine. Messages that trip these checks get held for review instead of landing in an inbox, which catches the attachments that look legitimate but are not.
Training that people actually remember
Staff are your last line of defence, not a weak point to be tolerated. The training that sticks uses real, industry-relevant examples rather than generic slideshows, and treats reporting a suspicious email as a normal, encouraged action rather than an admission of nearly getting caught.
Simulated phishing, done properly
Simulations should teach, not humiliate. Staff who click a test email need a short explanation of what gave it away, not a black mark. Track results over time to see whether the message is actually landing, not just to generate a report.
Different teams, different risks
Finance staff dealing with wire transfers face different attacks than legal staff handling contracts. Training that reflects the specific risk in front of each team lands better than a generic, one-size-fits-all module.
The technical controls worth prioritising
Multi-factor authentication
MFA is the highest-value control on this list. A stolen password on its own stops being useful to an attacker the moment a second factor is required.
Endpoint detection and response
EDR gives visibility into what is actually happening on a device, catching unusual process behaviour in time to contain it before it spreads.
DMARC, SPF, and DKIM
These three records let receiving mail servers verify that a message claiming to be from your domain actually is. Without them, spoofing your own brand in a scam email is trivial for an attacker.
Remote and hybrid teams
Security policy needs to travel with the device, not stop at the office door. Consistent controls on a home laptop matter just as much as they do in the office.
When it goes wrong anyway
Even good defences get breached sometimes. What separates a contained incident from a disaster is a written plan people already know, not one written during the incident itself.
Roles, decided in advance
Decide who leads the technical response, who handles communication, and who manages legal and regulatory obligations before you need to know. Working this out during a live incident costs time you do not have.
Containment and investigation
Isolate affected systems immediately to stop lateral movement, then investigate once the immediate threat is contained. Trying to do both at once usually does neither well.
Talking to the people affected
Clients and partners whose data was involved deserve a clear, timely update. Silence or vague statements do more damage to trust than the breach itself.
Keep the evidence
Preserve logs and system snapshots before you start cleaning up. That evidence is what tells you whether the gap has actually been closed or just papered over.
Staying on top of it
A security dashboard that shows incident history, patch status, and current threat trends in one place is worth more than a folder of disconnected reports. It is what turns “we think we are secure” into something you can actually demonstrate to an auditor, an insurer, or a client.
The balance to get right is security that people do not route around. Controls that block legitimate work get bypassed. Controls that fit how people actually work get followed.
Frequently Asked Questions
What are the main signs of a phishing message
An urgent tone, an unfamiliar sender or link, poor grammar, or an unexpected request for sensitive information or payment. Any one of these is reason enough to check before acting.
Why does social engineering work so well
It exploits trust rather than a technical flaw. A message that looks like it comes from someone you know, asking for something plausible, does not trigger the same suspicion as an obvious scam.
How does multi-factor authentication stop an attacker with a stolen password
It requires a second form of proof beyond the password, such as a code or an approval on a phone. Without that second factor, a stolen password alone is not enough to get in.
What is the point of phishing simulations if staff already had training
Simulations test whether the training actually changed behaviour under realistic conditions, and give a safe way to practice spotting a real attempt without any real risk.
Why does a centralised security dashboard matter
It gives one place to see system activity, incident history, and overall security health, which makes faster decisions possible and gives you something concrete to show an auditor or insurer.
What should happen in the first hour after a suspected breach
Isolate the affected systems, follow the documented containment plan, and start communicating with the people who need to know. Acting on a plan beats improvising every time.
Does keeping software updated actually help against phishing
Yes. Many phishing emails deliver malware that exploits a known, unpatched vulnerability. Closing that gap removes one of the attacker’s easiest paths in.
