Phishing Protection and Staff Training in Ely

Why This Work Matters Before We Get Into the Steps

Phishing emails are responsible for the majority of cyber incidents affecting small businesses in the UK. An attacker sends a convincing email to a member of staff, the staff member clicks a link or enters their password on a fake page, and the attacker is inside your Microsoft 365 account within seconds. From there they can read your emails, access shared files, impersonate you to clients or suppliers, and initiate fraudulent payments.

For businesses in Ely and the surrounding area - as well as those we support in Bury St Edmunds, Cambridge, Mildenhall, Brandon, Thetford and Stowmarket - this is not a theoretical risk. It is the most common route through which small businesses lose data, money and client trust. The work to address it is practical and achievable, and the steps below explain exactly what it looks like from start to finish.

Step One: Understanding Where You Stand

The first conversation covers three things: what email platform you use, how many staff use business email accounts, and whether any security configuration has been done before. For most small businesses on Microsoft 365, the answer to the third question is "some of the defaults, but not much beyond that" - and that is a normal starting point, not a criticism.

We also ask about your processes: how do staff handle unexpected payment requests? Is there a process for verifying a supplier's bank details before changing them? Do staff know who to contact if they receive a suspicious email? These questions are not about catching anyone out - they tell us which parts of the work matter most for your particular business.

We may also ask whether you have had any phishing incidents previously. Even if an attack was caught before it caused damage, it gives useful context about the types of message your staff are already seeing.

Step Two: Auditing Your Microsoft 365 Security Settings

Before touching any settings, we look at what is already in place. This audit covers the areas most commonly left at default or misconfigured in small business Microsoft 365 tenants.

The audit checks:

• SPF, DKIM and DMARC records for your domain - these email authentication standards prevent attackers from sending emails that appear to come from your domain. Their absence or misconfiguration is one of the most common gaps in small business email security.
• Microsoft 365 Defender anti-phishing policy settings - are they active, and are they configured for your organisation rather than left at the Microsoft default?
• Safe Links and Safe Attachments status - are these features enabled? Are they covered by your current Microsoft 365 licence tier?
• External sender warnings - do emails from outside your organisation display a banner to warn the recipient?
• Multi-factor authentication status - which accounts have MFA enabled, and are there any accounts that do not?
• Shared mailboxes and admin accounts - these are often overlooked and can provide an entry point if not properly secured.

We document what we find and go through it with you before making any changes. You will see clearly what the current state is and what we are proposing to change, and why.

Step Three: Configuring the Technical Controls

Once you have agreed to proceed, we make the changes identified in the audit. This is remote work done within office hours - we do not need physical access to your machines for the DNS and Microsoft 365 configuration.

Setting up SPF involves adding or correcting a DNS record with your domain registrar or hosting provider. DKIM is enabled through the Microsoft 365 admin portal and requires a corresponding DNS record to be added. DMARC is a further DNS record that ties both together and specifies what happens to messages that fail authentication. We set DMARC at monitoring level first, review the reports over a short period to check no legitimate mail is being incorrectly flagged, then move to a stricter policy.

Within Microsoft 365 Defender, we configure anti-phishing policies to reflect your organisation - your known contacts, your supplier domains, your user list. We enable external sender tagging and set up quarantine reporting so that you and your staff can see what is being held rather than messages disappearing silently.

Where your licence includes Safe Links and Safe Attachments, we enable and configure those too. If your licence does not include them, we will tell you clearly what would need to change to access those features rather than pretending the protection is in place when it is not.

Multi-factor authentication is enforced for all accounts where it is not already active. Staff are given clear guidance on setting up the Microsoft Authenticator app before MFA is switched on for their account, so there is no confusion or lockout.

Step Four: Preparing for Staff Training

Good training is built around the specific context of your business, not generic slides. Before we run a session, we ask about the types of email your team handles most, the processes they follow for payments and file sharing, and any real phishing attempts they have already seen. Where you have examples of suspicious emails that staff have previously received, these are ideal material - nothing illustrates the point better than a real attack your own team encountered.

We agree on format and timing. Training can be delivered in person at your premises in Ely or remotely over Microsoft Teams - both approaches work well for small teams. Sessions are scheduled during office hours and we work around your operational needs. A session covering the core material typically runs around an hour; follow-up or refresher sessions are shorter.

Step Five: Running the Training Session

The session itself covers warning signs staff need to recognise: how to check a sender address properly in Outlook, how to inspect a link without clicking it, what urgent language and social engineering tactics look like in practice, and how to spot a spoofed internal email - a message that appears to come from a director or colleague but does not.

We use real examples of phishing emails throughout. Staff work through messages and make the judgements they would face in real life - is this genuine or not, and why? This is more effective than listing rules because it builds the habit of active scrutiny rather than passive recognition of a checklist.

We also cover response: what staff should do when they are unsure about an email, how to report a suspicious message using Outlook's built-in reporting tool, and what to do if they have already clicked a link or entered credentials. That last scenario matters because the instinctive response to realising a mistake has been made is often to say nothing - which is the worst possible outcome for the business.

Questions from staff are encouraged throughout. The judgement calls around email are often genuinely difficult, and a session that acknowledges that is more credible than one that implies everything is obvious.

Step Six: Simulated Phishing Tests

After the initial training session, we can run simulated phishing tests - realistic fake phishing emails sent to your staff without advance warning. These are not designed to catch people out or embarrass anyone; they are the only reliable way to measure whether training has changed behaviour and to identify which staff need additional support.

The test results show who clicked the link, who entered credentials and who reported the message correctly. We go through the results with you and, where appropriate, use them as the basis for a follow-up session targeted at the specific scenarios that caused difficulty.

A programme of simulations run at intervals over several months gives a meaningful picture of improvement. A one-off test gives a snapshot that may not be representative - a particularly convincing test message on a busy Monday morning will always produce a higher click rate than the same message on a quiet Tuesday afternoon.

Step Seven: Checking That Everything Works

Once the technical changes are in place and training has been delivered, we do a final check. DMARC reports are reviewed to confirm the policy is working as intended and no legitimate mail is being incorrectly rejected. Microsoft 365 Defender quarantine logs are checked to ensure messages are being caught at the right level. MFA is confirmed active on all accounts.

We also confirm that your staff know what the reporting process is and that any reports they make are going to the right place. A reporting culture only works if staff believe their reports are being acted on - even a brief acknowledgement that a reported message has been reviewed maintains that trust.

Step Eight: Keeping Protection Current

Phishing tactics change constantly. A training session and a configuration review done once will lose relevance over time. The technical controls need checking when your Microsoft 365 environment changes - new domains, new users, changes to your email licence. Training needs refreshing when new techniques emerge or when staff turnover brings in people who have not been through a session.

For businesses on a support contract with us, security settings are kept under review as part of the ongoing service. For others, an annual or biannual check of the technical configuration alongside a refresher training session is a sensible minimum.

What This Costs

Phishing protection and staff training work is available as part of an ongoing support contract or as pre-paid time blocks.

Business Essentials covers unlimited remote and phone support during office hours, updates, backups and security monitoring. On-site visits are charged at £60 call-out plus labour. Pricing per computer per month: one computer £36, two to three £31.20 each, four to nine £25.20 each, ten to seventeen £22.20 each, eighteen or more £21.60 each.

Business Premium includes everything in Business Essentials with on-site labour and call-outs included. Pricing per computer per month: one computer £54, two to three £42 each, four to six £38.60 each, seven to nine £33.80 each, ten to twelve £31.20 each, thirteen to fifteen £28.40 each, sixteen to nineteen £25.40 each, twenty or more £24.40 each.

Pre-paid time blocks (no monthly contract): four hours £312, eight hours £592 or sixteen hours £1,123, each excluding VAT and valid for up to six months, with monthly monitoring and priority service included. A managed email service is also available and is quoted on request.

All prices exclude VAT. Contracts are billed per computer per month, not per user.

Talk to Us About Phishing Protection in Ely

We support small businesses in Ely and across the region - including Bury St Edmunds, Cambridge, Mildenhall, Brandon, Thetford and Sudbury - on Windows PCs, laptops and Microsoft 365. If you want to know what your current setup looks like and what a proper protection programme would involve for your team, call us during office hours to start the conversation.