Phishing Protection and Staff Training in Thetford

Why Phishing Remains the Number One Threat to Small Businesses

Phishing emails are responsible for the majority of cyber incidents affecting small businesses in the UK. The attacks are not always dramatic - many start with a single member of staff clicking a link in what looked like a routine message. By the time the damage is visible, the attacker may already have been inside the email account for days.

Businesses in Thetford, Bury St Edmunds, Mildenhall, Brandon and the surrounding area are as exposed as businesses anywhere. Attackers do not target specific towns - they target organisations with gaps in their defences, and small businesses are frequently those organisations.

What Phishing Protection Involves

Effective protection has two elements that work together. The technical side configures your email system to reject or filter spoofed and forged messages before they reach your staff. The human side trains staff to recognise the messages that still get through and to respond correctly. Neither element alone is sufficient - filters miss things, and staff without training make mistakes that filters cannot catch.

We work with Windows PCs, laptops and Microsoft 365. If your business uses Outlook and Microsoft 365 email, we can review your current configuration, tighten up the settings that matter most and run practical training with your team in the tools they use every day.

The Technical Layer: Anti-Spoofing Settings That Should Be in Place

The three settings that make the biggest technical difference are SPF, DKIM and DMARC. SPF specifies which mail servers are allowed to send email from your domain. DKIM adds a cryptographic signature to outgoing email that confirms it genuinely came from you. DMARC tells receiving mail servers what to do when an email fails those checks - at its most effective, it instructs them to reject or quarantine the message rather than let it through.

Many small business Microsoft 365 accounts have DMARC set to "none", which means it monitors without taking any action. This is better than nothing, but it does not actually stop spoofed messages from reaching recipients. Moving DMARC to enforce mode, after checking that SPF and DKIM are correctly configured first, is one of the most impactful steps a small business can take. A DMARC record also generates reports, requested with the rua tag, that show whether anyone is attempting to spoof your domain, whatever the policy setting - useful information in its own right.

The Warning Signs a Phishing Email Has Been Clicked

Most businesses do not find out about a phishing incident when it happens - they find out later, when the consequences become visible. Knowing what to look for means you can catch problems earlier, when there is still time to limit the damage.

The following are warning signs that a phishing attack may have succeeded, or that one is ongoing:

• Staff report receiving unusual replies to emails they did not send. This can mean an attacker is using the account to send phishing or spam messages to your contacts. It is one of the more visible signs because external recipients often reply to complain.
• Contacts or clients report receiving strange emails from your business. If the attacker is spoofing your domain rather than logging into the account directly, recipients will see your name and email address on messages you never sent.
• A staff member notices they cannot log into their account. Attackers sometimes change the password to lock the legitimate user out, particularly if they want uninterrupted access.
• Emails are disappearing from an inbox. A forwarding or deletion rule added by an attacker can cause incoming emails to vanish before the user sees them. This is a common tactic used to intercept invoice or payment communications.
• A Microsoft 365 security alert arrives about a sign-in from an unfamiliar location. These alerts are worth taking seriously rather than dismissing. A login from an unexpected country is a strong indicator that credentials have been compromised.
• Staff are prompted to re-enter their Microsoft 365 password more often than usual. This can indicate that someone is attempting to use the account from elsewhere and the system is detecting unusual activity.
• A user reports that they clicked a link in an email and were taken to a page asking for their Microsoft or email password. This is a credential harvesting attack. Even if the user did not enter their password, they should report it immediately.

What Causes These Warning Signs: How Phishing Attacks Work

Understanding why these things happen makes it easier to spot them and to explain them to staff.

The most common mechanism is credential theft. An attacker sends an email that appears to come from Microsoft, a courier company, a bank or a colleague. The email contains a link to a fake login page that looks identical to a real one. The user enters their email address and password, the attacker captures them, and then uses them to log into the real account. From inside the account, the attacker can read emails, set up forwarding rules, impersonate the account holder or send messages to the organisation's contacts with further phishing links.

A second mechanism is malware delivery via attachment. An email arrives with a Word document, PDF or ZIP file attached. Opening it runs malicious code that can install software giving the attacker remote access to the machine, or that encrypts files and demands a ransom. Modern versions of these attacks often use macros in Office documents, which is one reason Microsoft now disables macros from external sources by default in Microsoft 365.

A third mechanism is business email compromise (BEC). Rather than using a link or attachment, the attacker sends an email that appears to be from a senior person in the organisation - or from a supplier - asking for a payment to be made to a new bank account, or for credentials to be shared. These emails often contain no links at all, which means they are harder for filters to catch. The convincing factor is the apparent sender identity and the authority it implies.

Each of these mechanisms exploits a different weakness. Credential theft exploits a lack of scepticism about login prompts. Malware delivery exploits the habit of opening attachments without checking. Business email compromise exploits the tendency to act on instructions from apparent authority figures without verifying them through a separate channel.

What Causes Filters to Miss Phishing Emails

Spam and phishing filters work by matching incoming emails against known patterns, sender reputations and structural features. Attackers know this and adapt to avoid detection. A common approach is to send phishing emails from a domain that has only recently been registered and has not yet been flagged as malicious. Another is to host the fake login page on a legitimate service - a compromised website, a cloud storage link or even a Microsoft form - so the URL does not trigger any filters.

Spear phishing takes this further. Rather than sending identical messages to thousands of recipients, the attacker researches a specific target and crafts a message that references real names, ongoing projects or recent events. These personalised attacks are far more convincing and far less likely to be caught by filters because they do not match any known pattern.

This is why technical filters, however well configured, cannot be the only line of defence. A filter that catches 99% of phishing emails still lets one in every hundred through, and for a small business receiving fifty emails a day, that is a meaningful number of risky messages reaching staff inboxes.

What Staff Training Addresses

Training gives staff the knowledge to catch the messages that filters miss. A practical session covers how to check the actual sender address rather than just the display name, how to verify a link destination before clicking, how to recognise the pressure and urgency language that appears in the majority of phishing messages, and what to do - specifically - when something looks wrong.

That last point matters more than it might seem. Staff who suspect an email is a phishing attempt often do one of several unhelpful things: they ignore it and delete it, they forward it to colleagues asking "is this real?", or they report it verbally but do not take any action that would actually help contain the threat. Training should include a clear, simple process for reporting suspicious messages that creates a record and alerts whoever is responsible for IT.

Phishing simulation exercises complement training by sending realistic but harmless fake phishing emails to staff and measuring who clicks. The results identify which individuals need more support and which types of message the team finds hardest to spot. Simulation programmes are priced on request.

Dark Web Monitoring

Stolen credentials from successful phishing attacks are frequently sold on the dark web. Dark web monitoring scans known breach databases for your business email addresses and passwords. If a match is found, you can reset the affected credentials before an attacker uses them. This service is particularly useful for businesses that have not recently reviewed which email accounts may have been compromised in historic breaches. Pricing is quoted on request.

Common Misconceptions About Phishing Risk

A widespread assumption among small business owners is that antivirus software covers phishing. Antivirus identifies known malware - it does not protect against a staff member entering their password into a fake login page, and it does not catch business email compromise attempts that contain no malicious code at all. The protection needs to match the actual nature of the threat, which in most cases is social engineering rather than malware.

Another misconception is that multi-factor authentication (MFA) is too complicated for a small business to implement. MFA - where a second verification step is required after entering a password - is one of the most effective single controls against credential theft. Microsoft 365 supports it for all accounts. It is not complicated to enable, and once staff are used to it the additional step takes a few seconds. Even if an attacker obtains a password through phishing, MFA stops them from logging in without the second factor.

Support Plans and Pricing

Support is available during office hours.

Our Business Essentials plan covers unlimited remote and phone support, updates, backups and security monitoring, billed per computer per month (excluding VAT):

• 1 computer: £36 per month
• 4 to 9 computers: £25.20 each per month
• 10 to 17 computers: £22.20 each per month
• 18 or more computers: £21.60 each per month

On-site visits under Business Essentials are charged at £60 call-out plus labour. Business Premium includes on-site visits within the monthly fee:

• 1 computer: £54 per month
• 2 to 3 computers: £42 each per month
• 4 to 6 computers: £38.60 each per month
• 7 to 9 computers: £33.80 each per month
• 10 to 12 computers: £31.20 each per month
• 13 to 15 computers: £28.40 each per month
• 16 to 19 computers: £25.40 each per month
• 20 or more computers: £24.40 each per month

If you prefer not to commit to a monthly contract, pre-paid time blocks are available: 4 hours for £312, 8 hours for £592 or 16 hours for £1,123. A managed email service is also available - call for details.

Phishing simulation programmes and dark web monitoring are quoted on request based on your team size and requirements.

Getting Started

If you want to understand the current state of your phishing defences before deciding what to do next, call us. We can review your Microsoft 365 anti-spoofing settings, assess whether MFA is in place across all accounts and discuss what a training session for your team would involve. There is no obligation to take a support contract - we can work from a pre-paid time block if that suits you better.