Over 90% of attacks start with an email.

Forget Hollywood hacking — the attack that empties business bank accounts is an email. It looks like it's from your MD ('are you at your desk? I need a payment made quietly'), from a supplier ('our bank details have changed'), or from Microsoft ('your password expires today'). This is Business Email Compromise — CEO fraud — and it works because the email looks right and arrives on a busy Tuesday. Defending against it takes layers: advanced filtering that scores impersonation attempts (display-name tricks, lookalike domains, first-time senders asking for payments), link and attachment detonation before delivery, and warning banners that make 'this came from outside' impossible to miss on the exact emails that matter.

The other half of the problem is your own domain being weaponised: criminals sending mail that claims to be from your business — to your customers, with your name on the invoice. The defence is DMARC, built on SPF and DKIM: DNS records that tell the world's mail servers which senders are genuinely you, and instruct them to bin everything else. Most UK small businesses have these misconfigured or absent — which is both why spoofing works and why their own legitimate mail lands in spam. We audit, configure and monitor all three, then move your DMARC policy to full enforcement once we've verified nothing legitimate breaks.

Underneath the clever attacks sits the volume: spam, malware attachments, credential-phishing blasts. Modern filtering (including Microsoft Defender for Office 365, configured properly rather than left on defaults) removes this before staff ever see it — because the honest truth of security is that a tired employee will eventually click, so the winning strategy is making sure the email never reaches them. Add MFA everywhere so a stolen password is useless, and you've closed the two doors almost every real-world breach walks through.

A scoped stack, not a sticker: filtering and impersonation protection tuned to your business (your suppliers, your payment patterns, your VIP spoof-targets), SPF/DKIM/DMARC configured and enforced, MFA rolled out with minimal grumbling, warning banners, and — where you want it — periodic simulated phishing so the team learns on harmless bait. Sits naturally with Microsoft 365 and wider cyber security; priced per user, scoped honestly.