Phishing Protection and Staff Training in Burwell

Why Phishing Is Still the Biggest Threat to Small Businesses

Phishing emails are behind the majority of cyber incidents that affect small businesses in the UK. An attacker sends a convincing-looking message, a member of staff clicks a link or enters credentials, and the damage is done - often before anyone realises something is wrong. Filters and firewalls help, but they cannot catch everything. The staff member reading the email is always the last line of defence.

For businesses in Burwell and the surrounding area, the risks are the same as anywhere else. Small teams, busy inboxes and a level of trust in familiar-looking sender names create exactly the conditions attackers exploit.

What Phishing Protection Actually Involves

Effective phishing protection has three layers. The first is technical: configuring your email system so that spoofed or forged messages are more likely to be caught before they reach anyone's inbox. The second is human: training your staff to recognise the signs of a phishing attempt and to report it rather than act on it. The third is ongoing: checking that both layers are still working as your business and the threat landscape change.

On the technical side, there are three anti-spoofing settings that every Microsoft 365 mailbox should have properly configured: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance). Many small business accounts have these partially set up or set to a mode that logs problems but takes no action. Tightening them up is one of the most effective steps you can take, and it does not require any change to how staff use email day to day.

On the human side, training does not have to mean a full-day course that takes staff away from their work. Practical, short sessions focused on what real phishing emails look like - including the ones that get past filters - are far more effective than a lengthy slideshow. Staff need to know what to look for and, critically, what to do when they spot something suspicious.

What We Cover in a Training Session

A practical phishing awareness session covers the following:

• How to check the actual sender address, not just the display name
• What urgency and pressure in an email message usually signals
• How to hover over a link without clicking it to see where it really goes
• Why attachments from unknown senders - and even known ones - should be treated with caution
• The difference between a legitimate password-reset request and a fake one
• How to report a suspicious message in Outlook without accidentally forwarding it

We work with Windows PCs, laptops and Microsoft 365 accounts. If your business uses Outlook and Microsoft 365, we can walk staff through the exact steps in the tools they use every day, which makes the training stick.

Phishing Simulations: What They Are and Whether You Need One

A phishing simulation sends realistic but harmless fake phishing emails to your staff to see who clicks. If someone does click, they are shown an immediate explanation rather than being penalised. The results tell you which members of staff need more support and which types of message your team finds hardest to spot.

Simulations are particularly useful for businesses that have done some awareness training and want to test whether it has landed. They are also useful as a baseline before training starts, so you can measure improvement. Pricing for phishing simulation programmes is quoted on request, as the cost depends on team size and the frequency of simulations.

Dark Web Monitoring

Credential theft from phishing attacks often ends up on the dark web - lists of email addresses and passwords sold between criminals. Dark web monitoring checks whether any of your business email addresses or credentials have appeared in known data breaches. If they have, you can reset the affected passwords before an attacker uses them. This is a separate service to training and filtering, and pricing is quoted on request.

Common Misconceptions About Phishing Training

Many small business owners assume that phishing is something that only happens to large organisations, or that their email provider's built-in filtering is sufficient. Neither is true. Attackers actively target small businesses because they typically have fewer controls in place. And while Microsoft 365 does include spam filtering, it does not apply the anti-spoofing settings mentioned above unless someone configures them deliberately.

Another common assumption is that staff already know what a phishing email looks like. Modern phishing messages can be difficult to distinguish from legitimate emails. Attackers now use the real logos, formatting and language of banks, HMRC, courier companies and even internal IT departments. Staff who have not seen recent examples often underestimate how convincing these messages have become.

Aftercare: Keeping Your Defences Working After the Initial Setup

This is the area most businesses overlook once the initial setup is done and the first training session is complete. Phishing attacks change. New tactics appear regularly - attackers move from fake invoice emails to impersonating Microsoft support to QR code-based attacks - and staff need to know about them. A one-off training session will lose its effect over time as staff forget what they learned or as new people join the team.

On the technical side, email security settings can drift. Changes to your Microsoft 365 tenancy, new third-party tools sending email on your behalf, or updates to your domain can all affect whether your SPF and DMARC records are still working correctly. A record that was valid when it was set up can become outdated without anyone noticing.

Practical aftercare for phishing protection typically involves the following:

• Periodic checks of your SPF, DKIM and DMARC records to confirm they are still accurate and set to enforce rather than just monitor
• Reviewing DMARC reports, which tell you if anyone is trying to spoof your domain
• A short refresher session for staff every six to twelve months, updated with recent examples of phishing messages that have been seen in the wild
• A briefing for any new starters before they begin handling business email
• Checking that the process for reporting suspicious emails is still working and that staff are actually using it

Businesses that treat phishing protection as a one-time task tend to find themselves back where they started within a year. Attackers do not stand still, and your defences should not either.

Simple Maintenance That Prevents the Next Incident

The practical steps that make the biggest difference between incidents are not complicated. They just need to be done consistently. A few things worth building into your regular routine:

• Check your Microsoft 365 sign-in logs periodically for any logins from unexpected locations or at unusual times
• Make sure multi-factor authentication (MFA) is switched on for all accounts, including admin accounts - this alone stops the majority of credential-based attacks even if a password is stolen
• Keep a note of which third-party services send email using your domain, and update your SPF record when that list changes
• When a member of staff leaves, disable their account on the same day and review any email forwarding rules they had set up
• Review which accounts have administrator access in Microsoft 365 - admin accounts should be kept to the minimum number of people who genuinely need them

None of these tasks takes long individually. The difficulty for most small businesses is remembering to do them at all. A support contract that includes managed security monitoring can take most of this off your plate.

Support Plans and Pricing

We support Windows PCs, laptops and Microsoft 365 for businesses in Burwell, Bury St Edmunds and the surrounding area.

If you want ongoing managed support covering updates, backups and security monitoring, our Business Essentials plan is billed per computer per month (excluding VAT):

• 1 computer: £36 per month
• 2 to 3 computers: £31.20 each per month
• 4 to 9 computers: £25.20 each per month
• 10 to 17 computers: £22.20 each per month
• 18 or more computers: £21.60 each per month

On-site visits under Business Essentials are charged separately at £60 call-out plus labour. If you want on-site support included, Business Premium covers everything:

• 1 computer: £54 per month
• 2 to 3 computers: £42 each per month
• 4 to 6 computers: £38.60 each per month
• 7 to 9 computers: £33.80 each per month
• 10 to 12 computers: £31.20 each per month
• 13 to 15 computers: £28.40 each per month
• 16 to 19 computers: £25.40 each per month
• 20 or more computers: £24.40 each per month

If a monthly contract does not suit you, ask providers about pre-paid blocks of time, and check what each block includes and how long it stays valid. A managed email service is also available - contact us for details.

Phishing simulation programmes and dark web monitoring are quoted on request. Call us to discuss what your business needs and we will give you a clear picture of what is involved and what it costs.

What to Ask Before Choosing an IT Support Provider for Phishing Protection

Before committing to any provider, ask whether they will check your existing SPF, DKIM and DMARC settings as part of the initial setup - and whether they will set DMARC to enforce, not just monitor. Ask what the training session involves practically, and whether it uses real examples. Ask how they handle staff who join after the initial training. And ask what the ongoing arrangement looks like - is there a process for keeping your settings and staff knowledge up to date, or does it end when the first session is done?

The answers to those questions will tell you whether you are getting genuine phishing protection or a one-time exercise that will not last.