Phishing Protection and Staff Training in Cambridge

What Phishing Protection Means for a Small Business

Phishing is the technique attackers use to trick a member of staff into handing over credentials, making a payment or opening a file that installs malware. It arrives almost exclusively by email, and it accounts for the majority of cyber incidents affecting small businesses in the UK. The question for most small business owners is not whether to address it, but which combination of technical controls and staff training will actually work.

We support businesses in Cambridge and across the region - including Bury St Edmunds, Mildenhall, Brandon and Thetford - on Windows PCs, laptops and Microsoft 365. Everything below is written specifically for that environment.

The Technical Layer: Email Filtering and Anti-Spoofing

Before training enters the picture, there are technical controls that should be in place on every business email account. These are not optional extras - they are the foundation. Without them, no amount of staff awareness will fully compensate.

SPF (Sender Policy Framework) is a DNS record that tells the world which mail servers are allowed to send email on behalf of your domain. If an attacker tries to send a message that appears to come from your domain, a receiving server with SPF checking enabled can reject it. Setting SPF up correctly is straightforward; leaving it out means your domain can be impersonated with no technical barrier.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages so that the receiving server can verify the message has not been altered in transit. For Microsoft 365 users, enabling DKIM is a configuration step inside the Microsoft 365 admin portal. Many small businesses have never done it.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together and tells receiving servers what to do with messages that fail both checks: deliver, quarantine or reject. A DMARC policy set to "reject" gives you the strongest protection against your domain being spoofed. Starting at "none" (monitoring only) and moving to "quarantine" or "reject" over a few weeks is the sensible approach, as it avoids accidentally blocking legitimate mail during the transition.

The honest caveat: these three controls protect your domain from being spoofed, but they do not stop attackers registering similar-looking domains (such as your-company-narne.co.uk) and sending from those. That is why filtering and training still matter.

Microsoft 365 Defender: What It Does and What It Does Not Do

Microsoft 365 includes anti-phishing, anti-spam and safe links functionality through Microsoft Defender. The default settings provide a baseline level of protection, but they are not configured for every business's specific circumstances. A small professional services firm has different risks to a retail business - the types of supplier emails it receives, the payment processes it uses and the level of access different staff have all affect what a sensible policy looks like.

The features worth configuring properly include:

• Anti-phishing policies - these can be set to flag or block emails that impersonate known contacts or use lookalike domains.
• Safe Links - rewrites URLs in emails so that when a user clicks a link, Microsoft checks the destination in real time before allowing the page to load. This catches links that were clean at delivery but have since been redirected to malicious content.
• Safe Attachments - opens attachments in a sandboxed environment before delivering them to the user, adding a delay of a few seconds in exchange for checking for malware.
• External sender tags - adds a visible banner to emails originating outside your organisation, so staff are immediately prompted to apply more scrutiny.
• Quarantine reports - gives users and administrators visibility of what has been held, reducing the risk that a legitimate email is silently blocked without anyone knowing.

These features are included within Microsoft 365 Business Premium licences. If your business is on a lower-tier licence, some features may not be available - worth checking before assuming they are active.

The Honest Pros and Cons of Different Training Approaches

This is the section most providers gloss over. There are several ways to train staff on phishing, and each has genuine strengths and real limitations.

Online e-learning modules are easy to deploy and can be completed by staff at their own pace. They are cost-effective for larger teams and create a record of completion. The downside is that passive learning has limited impact on real-world behaviour. Staff can complete a module, score well on the test at the end, and still click a convincing phishing email a fortnight later. E-learning is useful for baseline awareness but insufficient on its own.

Live group training sessions - delivered either in person or over Microsoft Teams - allow staff to ask questions, work through real examples and discuss the judgement calls they would actually face. These sessions are more memorable than e-learning and allow the trainer to address the specific email types and processes relevant to that business. The limitation is time: a session requires everyone to stop work at once, and the content can go stale if not repeated regularly.

Simulated phishing tests send convincing fake phishing emails to staff without warning, then record who clicks the link or enters credentials. The data from these tests is genuinely useful: it tells you which staff are most at risk, which types of message are most likely to succeed and whether training has improved behaviour over time. The honest caveat is that a single simulation gives a snapshot, not a trend. A programme of simulations run over several months gives a much more reliable picture.

Dark web monitoring checks whether your business email addresses or credentials appear in known data breaches - lists of leaked usernames and passwords sold between attackers. If a staff member's work email and an old password appear in a breach, that credential may already be in use by attackers attempting to access your systems. This is not a training approach but it is a useful input that tells you which accounts need passwords changed and MFA enforced urgently.

The most effective approach combines all of these: technical controls as the foundation, live or e-learning training to build awareness, simulated tests to measure and reinforce behaviour, and monitoring to catch credential exposure. You do not have to implement everything at once - a phased approach based on your team size and current risk level is sensible.

Multi-Factor Authentication: Not Optional Any More

Multi-factor authentication (MFA) requires a second confirmation - usually a code sent to a phone or generated by an app - before a Microsoft 365 login is accepted. Even if an attacker obtains a password through a phishing attack, they cannot access the account without also having the second factor.

Enabling MFA across all Microsoft 365 accounts is one of the highest-impact, lowest-cost steps any small business can take. It does not require additional software - Microsoft Authenticator is free - and it can be enforced through Microsoft 365 admin settings. Staff need a few minutes of guidance the first time they set it up, but the process is straightforward on any Windows device or smartphone.

MFA is not a perfect defence - some phishing techniques, known as adversary-in-the-middle attacks, can intercept MFA codes in real time - but it stops the vast majority of credential-based attacks dead.

What Small Businesses Get Wrong About Phishing Protection

Several misconceptions cause businesses to underinvest in this area or invest in the wrong things.

Believing antivirus is sufficient. Antivirus software catches known malware on a device. It does not stop a staff member typing their password into a fake Microsoft login page. Credential theft leaves no malware footprint to detect.

Running training once a year. Phishing tactics change month by month. Annual training rapidly becomes out of date and its impact on behaviour fades. Quarterly awareness updates - even brief ones - maintain vigilance far more effectively.

Assuming small businesses are not worth targeting. Automated phishing campaigns target millions of addresses at once with no filtering for company size. Small businesses are also targeted specifically because they often supply larger organisations - attacking a small supplier can be a route into a larger client's systems.

Not telling staff what to do when they are unsure. Awareness training often focuses on recognition but not on response. If a staff member suspects an email is fraudulent, they need to know who to tell, how to report it in Outlook and what to do if they have already clicked a link. Without a clear process, suspicious emails go unreported and IT support has no visibility of what is circulating.

Pricing: What This Work Costs

Configuration of Microsoft 365 anti-phishing settings and anti-spoofing DNS records, combined with staff training, can be delivered as a standalone piece of work or as part of an ongoing support contract.

Our Business Essentials contract is billed per computer per month: £36 for one computer, £31.20 each for two to three, £25.20 each for four to nine, £22.20 each for ten to seventeen, and £21.60 each for eighteen or more. On-site visits are charged separately at £60 call-out plus labour.

Our Business Premium contract includes everything in Business Essentials with on-site labour and call-outs included. Pricing is £54 for one computer, £42 each for two to three, £38.60 each for four to six, £33.80 each for seven to nine, £31.20 each for ten to twelve, £28.40 each for thirteen to fifteen, £25.40 each for sixteen to nineteen, and £24.40 each for twenty or more computers.

If you prefer not to commit to a monthly contract, pre-paid time blocks are available: four hours for £312, eight hours for £592 or sixteen hours for £1,123, each excluding VAT and valid for up to six months. A managed email service is also available, quoted on request.

All contract prices exclude VAT and are billed per computer, not per user.

Questions Worth Asking Before You Decide

Whether you work with us or another provider, these are the questions that will tell you whether the protection being offered is genuine or superficial:

• Will you audit our current Microsoft 365 security settings and show us what needs changing?
• Will you check and configure our SPF, DKIM and DMARC records?
• Does your training include simulated phishing tests with results reported back to us?
• How often do you recommend repeating training, and what does that look like in practice?
• If a staff member clicks a phishing link during office hours, what do we do and who do we call?

Talk to Us About Phishing Protection in Cambridge

We support small businesses in Cambridge and across the region including Bury St Edmunds, Mildenhall and Brandon on Windows and Microsoft 365 during office hours. If you want an honest assessment of where your current setup stands, call us to arrange a conversation.