Phishing Protection & Staff Training in Mildenhall

Phishing is the most common way small businesses get breached

The majority of cyber incidents affecting small businesses start with a phishing email. Someone on your team receives a message that looks like it is from a supplier, HMRC or a colleague, clicks a link or opens an attachment, and the attacker gets what they came for - login credentials, a bank transfer or access to your files. For a small office, the fallout from a single successful attack can mean days of disruption and real financial cost.

Phishing protection is not one product you buy and install. It is a combination of technical settings, the right email tools and staff who know what to look for. This page explains what that work involves and - crucially - how to choose a contractor to do it properly, and what questions to ask before you agree to anything.

What phishing protection and staff training actually does

There are two distinct parts to a solid phishing defence: the technical layer and the human layer.

On the technical side, the work centres on your email platform. Microsoft 365 has several anti-spoofing controls that need to be correctly configured. SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC records tell the world's email systems which servers are authorised to send email from your domain. When these are set correctly, it becomes much harder for an attacker to send a convincing fake email that appears to come from your business. Getting them wrong is surprisingly common, and the consequences - legitimate emails bouncing, or criminals successfully impersonating your domain - are serious either way.

Beyond anti-spoofing, the filtering rules within Microsoft 365 can be tightened to catch suspicious attachments, lookalike sender addresses and known malicious links before they reach a staff member's inbox.

On the human side, staff training means equipping your team to catch what the filters miss. Filters are not perfect - new phishing campaigns can slip through before their signatures are known. Staff who understand what to look for, and who feel confident reporting something suspicious, are a meaningful second line of defence.

How to choose an IT contractor for phishing protection

This is where many businesses in Mildenhall and nearby towns like Bury St Edmunds, Thetford and Brandon make an expensive mistake: they choose a provider based on price alone, or they let an existing IT supplier add phishing protection as an afterthought without checking whether it has actually been configured correctly. Here is what to look for and what to ask.

Ask whether they specialise in Microsoft 365

If your business runs on Windows PCs and Microsoft 365, your IT provider needs to know that platform thoroughly. Anti-spoofing records, Defender for Office 365 settings, conditional access policies and safe links are all specific to the Microsoft environment. A generalist who dabbles in multiple platforms may not know the Microsoft 365 security configuration in the depth that a specialist does. Ask directly: do you work primarily with Microsoft 365 businesses?

Ask what is actually included in the setup

"Phishing protection" can mean different things to different suppliers. Some will configure your DNS records and call it done. Others will include filtering rules, training sessions and ongoing monitoring. Before you agree to anything, ask for a clear list of what is and is not included. Specifically, ask:

• Will you check and configure our SPF, DKIM and DMARC records?
• Will you review and tighten our Microsoft 365 email filtering settings?
• What does the staff training session cover, how long does it take, and is it done in person or remotely?
• How will you verify that the settings are working correctly after they are in place?
• What ongoing monitoring is included, and what happens when something needs to change?

Ask how ongoing support is structured

Email security is not a one-time fix. Phishing tactics change, Microsoft 365 settings update, and staff change over time. A business that trains its team once and never revisits the topic will find that new starters have no training and existing staff have forgotten the basics within months. Ask your prospective supplier how they handle this on an ongoing basis. Is it included in a support contract? Is it a separate annual session? Is there a cost for it?

Our support contracts include ongoing security maintenance as standard. Business Essentials contracts (from £25.20 per computer per month for a four-to-nine computer office, excluding VAT) include updates, backups and security kept in check. Business Premium contracts (from £38.60 per computer per month for a four-to-six computer office, excluding VAT) add on-site labour and call-outs. Training sessions for your staff and specific phishing protection setup work draw on your support arrangement - either through a monthly contract or through a pre-paid block of hours (4 hours for £312, 8 hours for £592, or 16 hours for £1,123, each valid for up to six months).

Ask about their response when something goes wrong

No protection is perfect. At some point, a phishing email may get through, or a staff member may click something they should not have. Ask your prospective supplier what happens in that scenario during office hours. How do you reach them? What does incident response look like? Can they audit what an attacker may have accessed? Support contracts may offer different response options, so ask what is available when you call.

Ask for honest pricing upfront

Vague pricing is a warning sign. A supplier who cannot give you a clear breakdown of what the setup costs, what the ongoing support costs and what falls outside the scope of what is included is a supplier who may surprise you with extras later. Ask for a written breakdown before you agree to anything. For managed email, pricing is quoted on request and depends on the number of mailboxes and your requirements - but you should still receive a clear figure before work begins.

Ask whether they can work with your existing Microsoft 365 subscription

Many of the best phishing protection tools for small businesses are already included in Microsoft 365 Business Premium, or can be added to lower tiers at relatively low cost. A good IT supplier will tell you honestly what your current subscription already provides and what, if anything, needs to be added or upgraded. Be wary of a supplier who wants to bolt on expensive third-party tools when the tools you need may already be in your subscription.

What good staff training looks like

A training session that changes behaviour is practical and specific. Staff should learn to check sender addresses carefully (not just the display name, but the actual email address), to hover over links before clicking to see where they really go, and to treat any unexpected request for login details or payment authorisation as suspicious regardless of how official it looks. Knowing how to report a suspicious email - and feeling confident doing so - is just as important as knowing what to look for.

Phishing simulations send controlled fake phishing emails to your own staff to test their responses. They can be a useful diagnostic tool, particularly for larger teams, because they show which individuals or departments need more attention. For smaller offices, a well-run group session often achieves the same practical outcome. Ask your prospective supplier which approach they recommend for your team size and why.

Common misconceptions worth clearing up

"We have antivirus, so we are covered." Antivirus catches malicious software. Most phishing attacks do not install software - they persuade a person to hand over their credentials or approve a fraudulent payment. Antivirus does not prevent that.

"Our email has spam filtering." Default spam filtering is designed to block bulk junk mail. Targeted phishing emails are different - they are personalised, well-written and sent from legitimate-looking addresses. They routinely pass through default spam filters unchallenged.

"We are too small to be a target." Small businesses are targeted specifically because their defences tend to be weaker. Phishing campaigns are largely automated; attackers do not manually choose victims. They send millions of emails and wait to see who responds.

"Our staff already know about phishing." Phishing has evolved significantly. Attacks today are personalised using information from LinkedIn or your company website, are grammatically correct and are designed to create a sense of urgency that overrides caution. Awareness from a few years ago does not reflect what a current attack looks like.

Dark web monitoring and why it matters

Dark web monitoring checks whether your business email addresses or staff credentials have appeared in known data breaches from third-party websites. If a staff member uses the same password for their work account as for a personal site that has been breached, that credential may already be available to attackers. Monitoring tells you when this has happened so you can act - resetting passwords and enabling multi-factor authentication - before someone uses those details to access your systems. Ask any prospective supplier whether this is included or available as part of their service.

Working with Mildenhall businesses

Support is provided during office hours.

If you are considering phishing protection for your Mildenhall business and want to understand what is actually involved before committing to a provider, call us and we can talk through your current setup, what is missing and what it would cost to address. We give you clear information so you can make an informed decision - whether you choose us or not.