Phishing Protection & Staff Training in Soham

Most small business breaches start with a phishing email

Phishing emails are behind the majority of cyber incidents affecting small businesses across the UK. The mechanism is straightforward: a message arrives that looks credible, a staff member clicks a link or opens an attachment, and the attacker gains access to email accounts, financial systems or internal files. The disruption that follows can be significant, and recovery costs real money and time.

For businesses in Soham and the surrounding area, the practical question is rarely "should we do something about phishing?" - it is "what exactly do we need to fix, and is a targeted repair enough or do we need to start from scratch?" That is what this page focuses on.

What phishing protection involves

A solid phishing defence has two sides. The technical side covers your email platform: configuring anti-spoofing records (SPF, DKIM and DMARC), tightening filtering rules within Microsoft 365 and making sure that suspicious links and attachments are blocked before they reach a staff member's inbox. The human side covers your team: making sure staff know what a phishing attempt looks like today, what to do when they are not sure about a message and how to report it without hesitation.

Both sides matter. Filters catch a lot, but they are not perfect - new phishing campaigns can slip through before they are identified. Staff who know what to look for are a genuine second line of defence. Equally, even well-trained staff will miss attacks that the technical layer could have caught automatically. The two work together.

Repair versus replace: how to think about your current email security

This is the key question for any Soham business that already has some form of email protection in place. The answer depends on what you have, how long ago it was set up and whether it has been maintained. Here is how to think through it.

When a targeted repair is usually enough

A targeted repair - reviewing and correcting what is already in place - is often the right answer when your Microsoft 365 tenancy is already set up, you have some filtering in place and the issues are specific rather than widespread. Common examples include:

• SPF, DKIM or DMARC records that are present but incorrect. This is a common problem. The records were set up at some point, but the domain registrar was not updated when email providers changed, or the DMARC policy was left on "none" (which monitors but does not block anything). Fixing this is targeted work - usually a matter of identifying what is wrong and correcting it in the DNS settings and the Microsoft 365 admin centre.
• Filtering that has never been reviewed. Microsoft 365 has baseline email filtering built in, but the default settings are conservative - they are designed to avoid false positives rather than to catch every threat. Tightening those settings is a specific, bounded piece of work rather than a rebuild.
• Staff training that has lapsed. If your team had phishing awareness training some time ago but has not had a refresher since, or if you have taken on new staff who have had no training at all, running an updated session is a straightforward addition to what you already have rather than a replacement for it.
• A single credential compromise. If one staff member clicked a phishing link and their account was accessed, the immediate response is to reset credentials, check for any mail forwarding rules the attacker may have set up and enable multi-factor authentication. That is targeted incident response, not a full rebuild of your defences.

When you need to rethink more fundamentally

Some situations call for more than a patch. A more fundamental overhaul is worth considering when:

• Anti-spoofing records have never been set up. If SPF, DKIM and DMARC have never been configured for your domain, you are operating with a significant gap that a targeted tweak will not address. Setting these up from scratch takes more time because each record needs to be written correctly, published, tested and monitored - getting them wrong can cause legitimate emails to fail to deliver, so the work needs to be done methodically rather than quickly.
• You have experienced a widespread compromise. If multiple accounts were accessed, or if an attacker had access to your email system for more than a short period, the scope of what may have been accessed is larger and the remediation work is more involved. This is the point where you need to audit what happened, not just patch the gap the attacker used.
• Your email setup has grown without a plan. Businesses that have added Microsoft 365 licences, changed email providers, acquired other companies or set up multiple domains over time often end up with an email configuration that is inconsistent and hard to audit. In these cases, straightening out individual settings is less effective than doing a clean review of the whole setup and rationalising it.
• Staff training has never happened at all. If there has genuinely been no phishing awareness training, a quick session is still better than nothing - but treat it as the first in a series rather than a one-time fix. Phishing tactics change, staff change, and the training needs to keep pace.

The practical test: what does your current setup actually do?

A useful starting point is to ask your IT provider to show you your current DMARC policy. If the answer is "p=none", your domain is being monitored but not protected - spoofed emails claiming to come from your domain can still be delivered to recipients. If the answer is "p=quarantine" or "p=reject", the policy is actively blocking unauthenticated messages. If no one knows the answer, that is itself a signal that the setup needs reviewing.

You can also check whether multi-factor authentication is enabled for all Microsoft 365 accounts. MFA does not stop phishing emails from arriving, but it means that if a staff member's credentials are stolen, the attacker still cannot log in without a second verification step. For many small businesses, enabling MFA across all accounts is the single highest-impact action they can take, and it costs nothing if you are already on Microsoft 365.

What a review and setup process looks like in practice

Whether you are repairing or rebuilding, the process follows a similar shape. First, we look at what you currently have: your DNS records, your Microsoft 365 filtering settings, which licences are in place and whether MFA is enabled. That review tells us what is missing, what is wrong and what is already working. From there, we can give you a clear picture of what needs to change and in what order.

For most small offices - say, four to ten computers - the technical setup work is a bounded, manageable piece of work.

Pricing: what does it cost?

Phishing protection setup and staff training draw on your IT support arrangement. We offer monthly contracts billed per computer per month (not per user), and pre-paid blocks of hours for businesses that prefer not to commit to a rolling contract. All prices exclude VAT.

Business Essentials contracts include unlimited remote and phone support, updates, backups and security kept in check. On-site visits are charged separately at a £60 call-out plus labour. Pricing: 1 computer £36/month; 2 to 3 computers £31.20 each; 4 to 9 computers £25.20 each; 10 to 17 computers £22.20 each; 18 or more computers £21.60 each.

Business Premium contracts include everything in Essentials plus on-site labour and call-outs. Pricing: 1 computer £54/month; 2 to 3 computers £42 each; 4 to 6 computers £38.60 each; 7 to 9 computers £33.80 each; 10 to 12 computers £31.20 each; 13 to 15 computers £28.40 each; 16 to 19 computers £25.40 each; 20 or more computers £24.40 each.

If a monthly contract is not right for your business, pre-paid time blocks are available: 4 hours for £312, 8 hours for £592, or 16 hours for £1,123. Each includes monthly monitoring and priority service, and is valid for up to six months. Phishing protection setup work and training sessions would draw from these hours.

A managed email service is available as a separate layer if you want additional filtering beyond what Microsoft 365 provides by default. Pricing for managed email is quoted on request based on your number of mailboxes and requirements.

Common misconceptions about phishing defences

"We have antivirus running on all machines." Antivirus targets malicious software already on a device. Most phishing attacks do not install anything - they persuade a person to hand over credentials or authorise a payment. Antivirus does not intervene in that process.

"We use Microsoft 365, so our email is secure." Microsoft 365 includes email security tools, but many of the most effective ones - DMARC enforcement, Safe Links, Safe Attachments, conditional access - require deliberate configuration. Out of the box, the default settings are not as protective as a properly configured tenancy.

"Staff know what phishing looks like." Modern phishing emails are personalised and well-written. Attackers research their targets using LinkedIn and company websites, then craft messages that reference real colleagues, suppliers or pending transactions. Awareness from two or three years ago does not prepare staff for what current attacks look like.

Dark web monitoring

Dark web monitoring checks whether your business email addresses or staff credentials have been exposed in known data breaches from third-party websites. If a staff member's work email and a reused password have been leaked, that information may already be circulating among attackers. Monitoring alerts you so you can reset passwords and take action before anyone uses those credentials. Ask about this when discussing your phishing protection setup.

Working with businesses in Soham

We are based in Bury St Edmunds and have been supporting businesses in the area since 1990. We work with Windows PCs, laptops and Microsoft 365 - that is our focus. Support is available during office hours. On-site visits are available when the work requires it.

If you are unsure whether your current email security needs a repair or a fresh start, call us and we can talk through what a review would involve. Businesses in Soham, and across nearby towns including Mildenhall, Bury St Edmunds and Thetford, can reach us on the number below.