Phishing explained: a corporate defence guide

The attack

Phishing uses deceptive messages to induce actions such as giving up credentials, opening malicious content or transferring money. Targeted versions use knowledge of a person or organisation to make the approach more credible. [NCSC: defending against phishing]

Build several chances to stop it

NCSC guidance recommends layers spanning prevention, user recognition/reporting, limiting the effect of missed messages and incident response. It explicitly cautions against treating staff detection or simulations as a complete defence. [NCSC: defending against phishing]

• Use gateway and mailbox security suited to the mail routes and licensed capabilities.
• Make suspicious-message reporting easy and connect it to an accountable incident queue.
• Protect identity with appropriate MFA and access controls; CISA recommends moving towards phishing-resistant MFA. [CISA: require multifactor authentication]
• Agree containment authority and evidence-handling arrangements before an incident.

What to ask of the email platform

Microsoft distinguishes baseline spoof protection from additional impersonation controls in Defender for Office 365, including selected users/domains and mailbox intelligence. Product tier and policy configuration matter. [Microsoft: anti-phishing policies]

Our review asks which threats the current controls address, where messages can bypass them and what happens after a report. The implementation plan includes tests for both malicious and legitimate mail, owner approval and rollback.

When an incident is suspected

Use your agreed security reporting route. Preserve relevant evidence and involve the identity, endpoint or fraud-response owners according to the incident. For payment manipulation, read BEC. GURU Protect coordinates the email response within your incident and change process.