Phishing Protection and Staff Training in Saffron Walden

What Phishing Protection Covers for Small Businesses

Phishing emails are behind the majority of cyber incidents affecting small businesses across the UK. Attackers send messages designed to look like they come from a bank, HMRC, a supplier or even a colleague. The goal is to get someone to click a link, enter their credentials or open an attachment. Once that happens, the attacker may have access to your email account, your files or your payment systems.

Effective phishing protection has two sides. The technical side involves configuring your email system to reject or flag messages that are spoofed or forged. The human side involves training staff to spot the messages that get through and to respond correctly rather than panic or make things worse.

The Technical Foundations: What Should Be Configured

If your business uses Microsoft 365, there are three anti-spoofing records that should be set up in your domain's DNS settings:

• SPF (Sender Policy Framework) - tells receiving mail servers which servers are allowed to send email from your domain. If someone tries to send a spoofed email pretending to be you, a correct SPF record makes it much easier for the recipient's mail server to reject it.
• DKIM (DomainKeys Identified Mail) - adds a digital signature to outgoing email so the recipient can verify it genuinely came from your domain.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) - tells receiving servers what to do when an email fails SPF or DKIM checks. At its most effective, DMARC is set to "reject" or "quarantine" rather than just "none" (which only monitors and takes no action).

A large number of small business Microsoft 365 accounts have these settings partially configured or set to monitoring mode only. Getting them to a fully enforcing state is one of the most effective technical steps you can take, and it does not change anything for staff in their day-to-day email use.

Staff Training: What a Good Session Looks Like

Awareness training does not need to be a full-day event. Short, practical sessions focused on real examples are more effective. Staff need to see what convincing phishing emails actually look like now - not the obvious ones with poor spelling, but the carefully crafted messages that impersonate Microsoft, HMRC, courier companies or even someone's own manager.

A useful session covers:

• How to check the actual sending address rather than just the display name
• What urgency and pressure in a message usually indicates
• How to check a link destination before clicking
• Why attachments from external senders should always be treated carefully
• The difference between a genuine Microsoft 365 sign-in prompt and a fake one
• How to report a suspicious message in Outlook correctly

We work with Windows PCs, laptops and Microsoft 365. Our training uses the actual tools your staff use, so the steps are immediately practical rather than theoretical.

Phishing Simulations and Dark Web Monitoring

A phishing simulation sends carefully constructed fake phishing emails to your team. Anyone who clicks is shown an explanation immediately rather than being penalised. The exercise tells you which staff members need more support and which types of message your team finds hardest to identify. Simulation programmes are priced on request, depending on team size and frequency.

Dark web monitoring checks whether your business email addresses or passwords have appeared in known breach databases - the lists sold between criminals after a large-scale data theft. If compromised credentials are found, you can change them before an attacker uses them. This service is priced on request.

Common Misconceptions About Phishing Risk

Many small business owners believe their email provider's filtering handles the risk adequately, or that phishing is primarily a problem for large organisations. Neither is accurate. Microsoft 365 includes useful filtering, but it does not apply the anti-spoofing settings above unless they are set up deliberately. And small businesses are actively targeted precisely because they tend to have fewer controls in place.

Another misconception is that one training session is enough. Staff who were trained a year ago may not recognise the tactics being used today. Attackers shift approaches regularly - QR codes in emails, fake voicemail notifications, supplier impersonation - and staff awareness needs to keep pace.

What to Do While You Wait for IT Support to Arrive

This is the section most businesses wish they had read before they needed it. If someone in your team has clicked a link in a suspicious email, entered their details somewhere, or you believe an account may have been compromised, there are steps you can take immediately that will limit the damage - and some things you should definitely not do.

What to Do Straight Away

Speed matters. The sooner the compromised account is locked down, the less an attacker can do with it.

• Change the password on the affected account immediately. Do this from a different device if you can - if the device that was used to click the link is compromised, logging in from it again may expose the new password too.
• Check whether multi-factor authentication (MFA) is set up on the account. If it is, an attacker who has the password still cannot log in without the second factor. If MFA is not set up, changing the password is your primary protection.
• Tell your IT support provider what happened. Write down or screenshot the email if it is still visible. The exact wording, the sender address and the link URL (do not click it again - just note the address) will help diagnose what the attacker was after.
• Check whether the email account has had any new rules added to it. A common tactic after gaining access to a mailbox is to add a forwarding rule that silently copies all incoming email to an external address. In Microsoft 365, you can check this in Outlook settings under Mail, then Rules.
• Check whether any emails have been sent from the account without the user's knowledge. Look in the Sent folder for messages the user did not send.

What Not to Do Yourself

When something goes wrong with security, the instinct is often to act quickly and fix it yourself. Some of that instinct is right. But a few actions can make things worse or destroy evidence that would help understand the scope of the problem.

• Do not delete the suspicious email immediately. Once deleted, it is harder to analyse. Forward it to your IT support provider first, or leave it in place until they advise otherwise.
• Do not run a full antivirus scan and then assume the problem is resolved. Antivirus tools detect known malware, but many phishing attacks rely on credential theft rather than malware. A clean antivirus result does not mean no harm was done.
• Do not tell staff "we had a phishing email, ignore anything suspicious" without guidance on what suspicious means. Vague warnings without specific detail are not useful and can create anxiety without improving behaviour.
• Do not reset everyone's password at once without a plan. If you reset passwords during an active compromise without also revoking active sessions in Microsoft 365, an attacker who is already logged in can remain logged in despite the password change.
• Do not assume the problem is contained because the affected staff member "only clicked a link." Some attacks deliver their payload on page load - the act of visiting the fake page can be enough.

Revoking active sessions in Microsoft 365 is something your IT support provider can do quickly. It forces any active login for that account to re-authenticate, which ejects an attacker who is currently in the account. This is one of the most important steps after a credential compromise and it is not something that can be done from Outlook alone - it requires access to the Microsoft 365 admin centre.

After the Immediate Response: Getting Properly Set Up

Once the immediate situation is dealt with, the focus should shift to making sure it cannot happen as easily again. That means reviewing whether SPF, DKIM and DMARC are properly configured, checking whether MFA is switched on for all accounts (including any admin accounts), and arranging a staff training session while the incident is still fresh.

Incidents like this often prompt businesses to look at their broader IT setup for the first time in years. It is worth checking who has administrator access in Microsoft 365 - admin accounts should be kept to the fewest people possible - and whether any former employees still have active accounts.

Support Plans and Pricing

Our Business Essentials plan includes unlimited remote and phone support, updates, backups and security monitoring, billed per computer per month (excluding VAT):

• 1 computer: £36 per month
• 2 to 3 computers: £31.20 each per month
• 4 to 9 computers: £25.20 each per month
• 10 to 17 computers: £22.20 each per month
• 18 or more computers: £21.60 each per month

On-site visits under Business Essentials are charged at £60 call-out plus labour. Business Premium pricing is as follows:

• 1 computer: £54 per month
• 2 to 3 computers: £42 each per month
• 4 to 6 computers: £38.60 each per month
• 7 to 9 computers: £33.80 each per month
• 10 to 12 computers: £31.20 each per month
• 13 to 15 computers: £28.40 each per month
• 16 to 19 computers: £25.40 each per month
• 20 or more computers: £24.40 each per month

If a monthly contract does not suit your business, pre-paid time blocks are available: 4 hours for £312, 8 hours for £592 or 16 hours for £1,123, valid for up to six months. A managed email service is also available - ask for details.

Phishing simulation programmes and dark web monitoring are quoted on request. Call us to talk through what your business needs.

What to Ask When Choosing a Local IT Provider

A local provider familiar with Microsoft 365 for small business has an advantage over a national helpdesk when something goes wrong: they can be on-site quickly if needed, and they already know your setup. Before you choose, ask whether they will review your existing anti-spoofing settings as part of the setup process, whether training covers current phishing tactics rather than generic advice, and what the process is if an incident happens out of office hours (check whether support is available outside office hours; it is worth knowing this in advance so you have a plan).

If you have had a suspicious email or want to get your defences in order before something happens, call us to discuss your situation.