Phishing Protection & Staff Training in Haverhill

Why phishing is the threat small businesses in Haverhill cannot ignore

Phishing emails are behind the majority of cyber incidents affecting small businesses in the UK. The message looks like it comes from a supplier, a bank or even a colleague, and a single click can hand an attacker access to your email account, your files or your payment systems. For a small business, that is rarely a minor inconvenience - it can mean days of lost work, costs to recover data, and the awkward job of telling customers their details may have been exposed.

The good news is that phishing protection is not complicated once you know where to invest. This page explains what the work actually involves, what drives the cost up or down, and what a sensible starting point looks like for a Haverhill business running Windows PCs and Microsoft 365.

What phishing protection and staff training actually covers

There are two sides to this: the technical layer and the human layer. Both matter, because attackers target whichever is weaker.

The technical side means configuring your email system correctly. Microsoft 365 has anti-spoofing settings - SPF, DKIM and DMARC records - that stop criminals from impersonating your domain. Many businesses have these either missing or set incorrectly, which means a fake email claiming to be from your company can land in a customer's inbox looking completely legitimate. Alongside that, email filtering rules can be tightened so that suspicious attachments, lookalike sender addresses and known malicious links are caught before they reach staff.

The human side means training. Filters catch a lot, but not everything. Staff who know what a phishing attempt looks like - an unexpected request for login details, a slightly wrong sender address, a link that hovers over to a strange domain - will catch what the filter misses. Training does not need to be a lengthy compliance exercise. The sessions that work best are short, practical and based on real examples staff might actually receive.

What does phishing protection cost - and what moves the price?

This is where many businesses get confused, because the cost of phishing protection is rarely a single fixed line item. It is made up of several components, and the total depends on choices you make along the way. Here is an honest breakdown.

Your IT support contract

If phishing protection is part of a managed support arrangement, the ongoing cost is built into your monthly fee. Our support contracts are priced per computer per month, not per user, and they include keeping security settings, updates and backups in check. As a guide (all prices exclude VAT):

• Business Essentials - 1 computer: £36/month. Remote and phone support, updates, backups and security monitoring included. On-site visits charged at a £60 call-out plus labour on top.
• Business Essentials - 2 to 3 computers: £31.20 each per month.
• Business Essentials - 4 to 9 computers: £25.20 each per month.
• Business Essentials - 10 to 17 computers: £22.20 each per month.
• Business Premium - 1 computer: £54/month. Everything in Essentials plus on-site call-outs and labour included.
• Business Premium - 4 to 6 computers: £38.60 each per month.
• Business Premium - 10 to 12 computers: £31.20 each per month.
• Business Premium - 20 or more computers: £24.40 each per month.

If you prefer not to commit to a monthly contract, blocks of pre-paid support time are available: 4 hours for £312, 8 hours for £592, or 16 hours for £1,123, valid for up to six months. Phishing protection setup and email configuration work would draw from that block of hours.

What pushes the cost up

Several factors make phishing protection more involved and therefore more time-consuming to set up properly.

• Your DNS records are missing or wrong. If SPF, DKIM or DMARC have never been configured, or were set up years ago and not maintained, putting them right takes careful checking. Getting them wrong can cause legitimate emails to bounce, so the work needs to be done methodically.
• Multiple domains. If your business uses more than one email domain - common if you have acquired another business or run separate brands - each one needs its own anti-spoofing records checked and set.
• A large or dispersed team. More staff means more training time, and if your people are spread across different sites or work largely from their own devices, organising sessions takes more co-ordination.
• No existing email filtering. Microsoft 365 has baseline filtering built in, but many businesses have never reviewed or tightened those settings. Starting from scratch takes longer than tuning a system that is already partially configured.
• Post-incident recovery. If you are coming to us after a phishing attack has already succeeded, there may be additional work to audit what was accessed, reset compromised credentials and check whether any mail forwarding rules were created by the attacker. That is a separate piece of work from standard setup.

What keeps the cost down

• You are already on Microsoft 365. The tools you need are already in your subscription. We are configuring what is there rather than adding new software.
• A small, office-based team. A compact team in one location is straightforward to train. A single session, run properly, can cover the essentials and be reinforced over time through a support contract.
• Clean DNS records. If your domain registrar records are tidy and accessible, setting up anti-spoofing is much faster.
• Ongoing contract rather than one-off work. A managed contract means security settings are checked as part of normal maintenance, rather than requiring a separate billable visit each time something needs updating.

Managed email as a separate layer

We also offer a managed email service as a standalone option. If your business relies heavily on email and you want an additional filtering layer on top of what Microsoft 365 provides, this is worth asking about. Pricing for managed email is quoted on request depending on the number of mailboxes and your specific requirements.

Common misconceptions about phishing protection

"Our antivirus covers us." Antivirus deals with malicious software that has already arrived on a device. Phishing attacks typically work by tricking a person into handing over credentials or authorising a payment - no malware involved. Antivirus will not stop a staff member clicking a convincing fake login page.

"We are too small to be targeted." Small businesses are targeted precisely because they tend to have weaker controls than larger organisations. Attackers often use automated tools to send millions of phishing emails at once; company size is not a filter they apply.

"Our staff already know what phishing looks like." Attacks have become significantly more convincing. Modern phishing emails are personalised, well-written and designed to mimic real communications from suppliers or internal systems. Staff who learned to spot obvious spelling mistakes years ago may not recognise what a current attack looks like.

"We already have spam filtering." Default spam filtering catches bulk junk, not targeted phishing. Tightening the configuration and adding anti-spoofing records is a separate task from basic spam protection.

What good training sessions look like

A training session that genuinely changes behaviour is short and practical, not a slide deck of compliance bullet points. Staff should leave knowing three things: what to look for, what to do when they are not sure, and how to report a suspicious message quickly without fear of being criticised for flagging it. A culture where staff feel confident reporting suspicious emails is one of the most effective defences a small business can build.

Phishing simulations - sending fake phishing emails to your own staff to see who clicks - can be a useful diagnostic tool. They show you which individuals or departments need more support, and they give staff a memorable, low-stakes experience of almost falling for an attack. Whether a simulation is worth running depends on the size and culture of your business; for some small teams, a well-run group session achieves the same result more efficiently.

Dark web monitoring: is it relevant?

Dark web monitoring checks whether your business email addresses or credentials have appeared in known data breaches. If a staff member's email and password combination has been leaked from a third-party site and they use the same password for their work account, that is an open door for an attacker. Monitoring does not prevent a breach elsewhere, but it tells you when your credentials have been exposed so you can act before someone uses them. Ask about this as part of any phishing protection conversation.

How we work with Haverhill businesses

We are based in Bury St Edmunds. We work with Windows PCs, laptops and Microsoft 365 - that is our focus.

Haverhill businesses are close enough for on-site visits when needed, and most email configuration and security setup work can be done remotely. If you are on a Business Premium contract, on-site visits are included in your monthly fee. If you are on Business Essentials or using a pre-paid block, on-site work is available at a £60 call-out plus labour.

If you want to understand what your current email security looks like before committing to anything, call us and we can talk through what a review would involve and what it is likely to cost for your specific setup.

Getting started

The starting point for most businesses is a conversation about how many computers you have, which version of Microsoft 365 you are on, and whether your DNS records have ever been checked. From there, we can give you a clear picture of what needs doing and what it will cost. Call IT Support Bury St Edmunds to arrange that conversation.