Category: Cyber Security

A stolen Microsoft 365 password should not be enough to expose client files, send fraudulent invoices or lock a team out of its own systems. Conditional access configuration puts practical checks around every sign-in, so access is based on the person, the device, the location and the level of risk – not simply whether a password was entered correctly.

For UK small and medium-sized businesses, this is one of the most effective ways to reduce the risk of phishing, credential theft and business email compromise without making day-to-day work unnecessarily difficult. Done well, it helps staff work securely from home, client sites and the office while giving leadership teams one less thing to worry about.

Why conditional access matters to your business

Microsoft 365 holds far more than email. It may contain customer correspondence, contracts, financial information, HR records, Teams conversations and files that keep operations moving. If an attacker gains access to one account, they may impersonate a director, search mailboxes for payment details, share malicious links internally or download sensitive documents.

Multi-factor authentication (MFA) is a necessary first step, but it does not answer every question. Should an administrator be able to sign in from an unmanaged personal device? Should a user logging in from an unusual country be challenged more strongly? Should older applications that cannot use modern authentication be allowed to connect at all?

Conditional Access in Microsoft Entra ID answers those questions through policies. It applies rules at the point of sign-in and can require MFA, a compliant device, an approved application or a password change. It can also block access where the circumstances do not meet your organisation’s requirements.

The commercial benefit is straightforward. A well-considered policy reduces the chance that a single compromised credential becomes a disruptive, expensive incident. It also supports sensible controls for remote workers, regulated information and cyber insurance expectations without forcing directors to become Microsoft security specialists.

Start with how people actually work

The strongest technical policy can still cause disruption if it is built around assumptions rather than working practices. Before changing settings, identify who accesses Microsoft 365, what they access and from where.

A professional services firm may need partners to reach email and files while travelling, but may insist that case-management information is only opened through managed devices. A logistics business may have office teams using full Microsoft 365 applications, while warehouse or driver-facing staff rely on shared devices and mobile apps. Those situations need different controls.

Consider the accounts that deserve particular attention: directors, finance staff, IT administrators, users with access to sensitive client data, and third parties. Attackers commonly target these groups because a successful sign-in can lead directly to payment fraud, privileged access or valuable data.

It is also worth documenting older systems, multifunction printers, line-of-business applications and external suppliers that send email through Microsoft 365. Some may still rely on legacy authentication methods. Finding them early prevents a security improvement turning into an avoidable operational issue.

Build conditional access configuration in the right order

Conditional access configuration is not one switch to turn on. It is a set of policies that should work together, with a clear purpose for each. Begin with the controls that close the most common routes into an account, then add more targeted restrictions as you understand your environment.

Establish a secure baseline

For most organisations, the starting point is to require MFA for users accessing Microsoft 365. Phishing-resistant methods, such as passkeys or security keys, offer stronger protection for higher-risk accounts than text messages. Microsoft Authenticator can be a practical option for many staff, provided number matching and sensible registration processes are in place.

The next priority is blocking legacy authentication. Older protocols often bypass MFA and are regularly exploited in password-spraying attacks. There can be exceptions for older equipment or applications, but these should be identified, recorded and addressed rather than left open indefinitely.

A sensible initial policy set normally covers four areas:

• Require MFA for all users, with a carefully managed approach for service accounts and shared operational devices.
• Block legacy authentication across the tenant.
• Require stronger sign-in controls for administrator accounts, ideally using managed devices and phishing-resistant MFA.
• Block access from countries or locations where your business has no legitimate reason to operate, where this is appropriate for your workforce.

Location-based blocking can be useful, but it is not a complete defence. Staff may travel, use mobile networks or connect through approved VPNs. Treat location as one useful signal among several, not proof that a sign-in is safe or unsafe.

Protect the accounts attackers value most

Administrative accounts require stricter treatment than standard user accounts. An administrator who can create users, change security policies or access mailboxes should not be protected by the same minimum controls as a basic account.

Require MFA every time or at a short sign-in frequency for privileged roles, restrict access to compliant devices where possible, and limit which staff hold permanent admin rights. Separate administrator accounts from everyday email accounts. This creates a little more administration, but it limits the damage if a normal user account is compromised through a convincing phishing email.

Finance and leadership teams may also benefit from tailored policies. Requiring a managed device for access to sensitive SharePoint sites, or applying stronger authentication when users access high-value applications, can reduce exposure without placing the same burden on every member of staff.

Plan exclusions carefully, especially emergency access

Every conditional access policy needs exclusions, but each exclusion creates a potential gap. The most significant example is the emergency or “break-glass” account. This is a tightly controlled administrator account held for genuine recovery situations, such as an MFA service issue or a badly configured policy that blocks normal administrators.

Keep at least two emergency accounts, exclude them from selected conditional access policies, use long unique passwords stored securely, and monitor any sign-in closely. They are not everyday accounts and should never be used for convenience.

Do not use broad exclusions simply to make a problem disappear. If a user, application or device cannot comply with a policy, establish why. The answer may be an application update, a managed device, a better authentication method or a time-limited exception with an owner and review date.

Service accounts need special care too. Where possible, replace user-name-and-password service accounts with managed identities, application permissions or modern authentication. Where this cannot yet be done, narrow their access, prevent interactive sign-ins and monitor their activity.

Test before enforcing and keep people informed

A rushed rollout can lock out staff at the point they need access most. Use Conditional Access report-only mode first to see how a proposed policy would affect real sign-ins. Review the results with the people who understand your operations, including finance, customer service and any teams working shifts or remotely.

Pilot policies with a small, representative group before extending them to everyone. Test common scenarios: a managed laptop at the office, a home connection, a mobile phone, a new device, travel where applicable, and access to each key Microsoft 365 application. Also test what happens when a user replaces a phone or cannot complete MFA.

Communication matters as much as the setting itself. Staff should know what will change, why they may be asked to verify a sign-in, and how to get fast help if something does not work. Clear support reduces frustration and makes people less likely to seek unsafe workarounds.

Treat policies as an operational control, not a one-off project

Your business changes. New starters arrive, suppliers change, staff travel, applications are adopted and roles develop. A conditional access policy that suited the business a year ago may now be too permissive, too restrictive or full of forgotten exceptions.

Review policies regularly alongside Microsoft Entra sign-in logs, risky sign-in alerts, device compliance reports and user feedback. Look for blocked activity that indicates an attempted attack, but also repeated legitimate failures that could affect productivity. Every policy should have a named owner, a documented business reason and an agreed review point.

Licensing also affects what is possible. Core Conditional Access capabilities generally require Microsoft Entra ID P1, while more advanced identity risk and risk-based controls may require P2. The right choice depends on the sensitivity of your data, your existing Microsoft 365 licences and the level of management your internal team can realistically maintain.

Some businesses prefer to own the policy decisions but ask a specialist to design, deploy and monitor them. Others want ongoing administration and a real person to call when a new system, acquisition or security concern changes the picture. MSnet can help businesses take either approach, combining Microsoft 365 protection with practical support and staff guidance.

The aim is not to put obstacles in front of legitimate work. It is to make an unusual or risky sign-in prove itself before it can become a serious problem – leaving your people free to focus on the work that moves the business forward.

A fraudulent email that appears to come from your finance director can be more damaging than a noisy spam campaign. It may ask for a bank-detail change, a rushed payment or a Microsoft 365 password reset, and it can reach a supplier or colleague before anyone has reason to question it. In the DMARC versus SPF discussion, the key point is that neither control should be treated as a complete answer on its own.

SPF, DKIM and DMARC are email authentication standards. Used properly, they make it much harder for criminals to send messages that impersonate your organisation’s domain. They also give receiving mail systems clearer instructions on what to do when a message fails authentication.

For a UK business handling client data, payments or regulated information, this is practical protection rather than technical housekeeping. It helps protect your reputation, reduces the opportunity for business email compromise and gives customers more confidence that genuine messages from your domain are genuine.

DMARC versus SPF: the practical difference

SPF stands for Sender Policy Framework. It is a DNS record that lists the mail servers and services allowed to send email on behalf of your domain. When a receiving server gets a message claiming to be from your business, it can check whether the sending server is on that approved list.

For example, if your business sends email through Microsoft 365, SPF can authorise Microsoft 365 to send mail for your domain. If you also use a CRM platform, payroll provider or marketing system that sends messages using your domain, those services may need to be included too.

SPF is useful, but it has a significant limitation. It checks the technical return path, sometimes called the envelope sender, rather than necessarily the address a recipient sees in the From field. A criminal may still be able to present an email as coming from your visible domain while using a different return path. SPF on its own does not give receiving systems a clear policy to reject that impersonation.

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It builds on SPF and DKIM by checking whether they align with the visible From address. It then tells receiving mail systems what to do when authentication fails.

That distinction matters. SPF says, in effect, “these systems are allowed to send”. DMARC says, “if an email claims to be from our domain and cannot prove it, handle it according to our policy”.

Where DKIM fits in

DKIM, or DomainKeys Identified Mail, is the other part of the picture. It adds a digital signature to outgoing email. The recipient’s email system checks that signature against a public key published in DNS, helping confirm that the message was authorised and has not been altered in transit.

DMARC can pass if either SPF or DKIM passes and aligns with the visible From domain. This is why treating the decision as simply DMARC versus SPF can be misleading. In a sound configuration, SPF and DKIM work together, while DMARC applies the policy and provides reporting.

DKIM is particularly valuable because SPF can fail during legitimate email forwarding. A forwarded message may be sent on by a server that was never included in your SPF record. A correctly configured DKIM signature can still give DMARC a route to pass that message.

What DMARC adds that SPF cannot

A DMARC record allows you to publish one of three policy levels. A policy of `p=none` asks receivers to monitor failures but take no enforcement action. `p=quarantine` asks them to treat failing messages with suspicion, often placing them in junk. `p=reject` asks them to refuse failing messages that claim to be from your domain.

The end goal for most organisations is reject, because it offers the strongest protection against direct domain spoofing. However, moving there too quickly can cause genuine messages to fail, particularly where old applications, outsourced platforms or departmental tools are sending email without the right configuration.

DMARC also generates reports. These show which services are sending email using your domain, whether they pass SPF and DKIM, and where unauthorised activity may be occurring. For a business leader, the reports are less about reading raw XML files and more about gaining a reliable view of an often-overlooked risk: who can send as your company?

This visibility can uncover forgotten systems. A booking platform, website form, scanner, legacy server or third-party supplier may be sending messages in your name without anyone in the business realising it. That is why DMARC deployment needs ownership and review, not just a record pasted into DNS and forgotten.

A sensible route to enforcement

The safest approach is phased. Start by identifying every legitimate source of email. This usually includes Microsoft 365 or Google Workspace, but may also include marketing platforms, finance applications, support desks, website hosting, multifunction printers and line-of-business systems.

Next, configure SPF carefully. Your record should authorise real senders and nothing else. Avoid creating several SPF records for the same domain, as this can cause checks to fail. SPF also has a limit of ten DNS lookups, so adding every provider without review can create its own delivery problems.

Then enable DKIM wherever your email providers support it. Microsoft 365 and many established cloud services provide a method to set this up, although the exact DNS entries vary by provider. Make sure the signing domain aligns with the From domain used in your outbound messages.

Once SPF and DKIM are in place, publish DMARC with `p=none`. Review reports over a meaningful period, particularly if your business has monthly billing cycles, seasonal campaigns or different operational teams sending communications. Correct any legitimate failures before increasing enforcement.

When the data is clean and understood, move gradually to quarantine and then reject. You can apply a percentage setting during the transition, allowing the policy to affect only a proportion of failing mail while you monitor the result. This is less dramatic than switching everything at once and gives the business room to deal with exceptions.

For organisations without the internal capacity to interpret reports or troubleshoot DNS changes, managed email protection can take that pressure away. The important thing is clear accountability: somebody should be watching the reports, validating new email services and maintaining the records as your systems change.

Common mistakes that create avoidable risk

The most common mistake is assuming SPF alone stops spoofing. It is a worthwhile control, but without aligned DKIM and DMARC enforcement, it leaves gaps that criminals can exploit.

Another is setting a strict DMARC policy before checking all authorised senders. This can affect legitimate invoices, appointment reminders or customer communications. The commercial impact may be felt before the technical cause is obvious, especially if messages are sent by a supplier outside your usual IT process.

Businesses also sometimes protect only their main domain while leaving closely related domains unprotected. A criminal may register a lookalike domain, which DMARC cannot prevent, or exploit an unused domain you already own. Domain monitoring, sensible registration practices and staff awareness still matter.

Finally, DMARC does not stop every dangerous email. It will not prevent a criminal from using a free email address, a compromised supplier account or a lookalike domain. It also does not protect an employee who enters credentials into a convincing phishing site. Effective protection combines authentication with email filtering, multi-factor authentication, secure password practices and practical phishing awareness training.

Choosing the right level of support

A technically confident organisation may be able to manage SPF, DKIM and DMARC itself, provided it has an accurate inventory of email services and time to review changes. Others will benefit from an expert-led setup and ongoing monitoring, especially where Microsoft 365, business-critical applications and multiple third parties are involved.

MSnet helps businesses treat email authentication as part of a wider protection plan, rather than an isolated DNS task. That approach connects the technical controls with the people and processes that keep email safe day to day.

The useful question is not whether to choose DMARC or SPF. It is whether your business can confidently prove which systems send in its name, block messages that should never carry its identity and respond quickly when that picture changes. Getting that right is one less thing to worry about when your team is busy running the business.

A compromised Microsoft 365 account can give a criminal a convincing route into your business. They may read invoices, impersonate a director, reset passwords elsewhere or use a trusted mailbox to target customers and suppliers. For a small or medium-sized business, the disruption can be far greater than the apparent size of the incident.

This Microsoft 365 security guide focuses on the safeguards that make a practical difference for UK businesses. The aim is not to turn directors or practice managers into cybersecurity specialists. It is to establish sensible controls, clear ownership and a recovery plan that lets your people work productively without leaving the front door open.

Microsoft 365 security guide: start with identity

Microsoft 365 is built around identity. If someone gains access to a staff member’s account, they can often reach email, Teams files, SharePoint sites and cloud-based business systems from one place. That is why identity protection should come before more visible but less decisive controls.

Multi-factor authentication, or MFA, should be enabled for every user, including directors, administrators, contractors and shared-service accounts where possible. A password alone is no longer enough protection against phishing, password reuse and credential theft. An authenticator app or security key provides much stronger assurance than a text message, although any form of MFA is better than none.

Do not stop at switching MFA on. Review how it is applied. Attackers increasingly use MFA fatigue tactics, repeatedly sending approval prompts until a distracted user accepts one. Number matching, location details and staff awareness training help people spot requests they did not initiate. Where the business handles particularly sensitive information, phishing-resistant authentication such as security keys may be appropriate.

Conditional access policies add another layer of control. These can require MFA when someone signs in from an unfamiliar location, block access from higher-risk countries, prevent use of outdated authentication methods and limit access from unmanaged devices. The right settings depend on how and where your team works. A logistics business with staff travelling internationally needs a different approach from a local accountancy practice, so policies should be tested carefully before broad enforcement.

Keep privileged access small and visible

Global administrator access is powerful and should be treated accordingly. It is not a convenience setting for everyone in IT, nor should it sit permanently on a day-to-day user account. A compromised admin account can create new users, alter security policies and make an attacker much harder to remove.

Keep the number of global administrators to an absolute minimum, use separate accounts for administrative work, and ensure there are at least two secure emergency access accounts. Review privileged roles regularly, particularly after changes in staff, external support arrangements or company structure.

This is also a good time to look at dormant accounts and shared mailboxes. Former employees, unused licences and old supplier accounts create unnecessary opportunities for intrusion. A reliable joiner, mover and leaver process is one of the most cost-effective security controls a business can have.

Strengthen email before fraud reaches your finance team

Email remains the main route for phishing, business email compromise and malware. Microsoft 365 includes useful email security capabilities, but default settings may not reflect your business’s level of risk.

Start by protecting your domain with SPF, DKIM and DMARC. These records help receiving systems identify whether a message claiming to come from your domain is legitimate. They are particularly valuable for protecting customers and suppliers from impersonation. DMARC should normally be introduced in stages, beginning with monitoring so legitimate services are not accidentally blocked.

Within Microsoft 365, review anti-phishing, anti-spam and malware policies. Impersonation protection can flag messages that appear to come from senior people, finance contacts or key suppliers. Safe link and attachment controls can reduce the chance that a user reaches a malicious website or opens harmful content, although they cannot replace sound judgement.

For payment changes, bank detail amendments or requests for confidential information, put a separate verification process in place. A phone call to a known number can prevent a costly mistake. Staff should never rely solely on an email thread, however familiar its wording or signature looks.

Protect data where people actually work

Teams, SharePoint and OneDrive make collaboration easier, but files can quickly be shared more widely than intended. The risk is often not a deliberate breach. It may be a folder shared with the wrong external contact, a sensitive document sent via a personal link or a former employee retaining access to a project site.

Review external sharing settings and agree who can invite guests, create Teams sites or share files outside the organisation. For many SMEs, a controlled approach works best: external collaboration is allowed where it supports clients and suppliers, but it has clear ownership, expiry dates and periodic reviews.

Sensitivity labels and data loss prevention policies can help when your organisation handles personal data, financial information, legal documents or commercially sensitive material. For example, a label may encrypt a board paper or prevent it being forwarded outside the business. These controls need thoughtful configuration. If they are too restrictive, staff will look for workarounds; if they are too relaxed, they may offer little protection.

For regulated firms, security settings should support wider governance requirements rather than sit separately from them. Retention, audit records, access reviews and documented processes all help demonstrate that sensitive information is being handled responsibly.

Secure the devices connecting to Microsoft 365

A well-protected Microsoft 365 tenant can still be exposed through an unsecured laptop or mobile phone. Devices used for business should have current operating systems, encryption, endpoint protection and screen-lock controls. Lost or stolen equipment should be capable of being remotely wiped where practical.

Mobile device management is especially useful when staff access email and documents on personal phones. It can protect business data within approved applications without giving the employer unnecessary visibility into an employee’s personal content. The policy needs to be clear and proportionate, particularly in businesses with a bring-your-own-device culture.

Patch management matters here too. Criminals often exploit known weaknesses after updates have already been released. A regular patching process, supported by reporting and escalation for devices that fall behind, reduces exposure without relying on people to remember every update themselves.

Back up Microsoft 365 data independently

Microsoft 365 provides availability and some recovery features, but that is not the same as having a dedicated, independently managed backup strategy. Accidental deletion, malicious deletion, ransomware and retention gaps can all create difficult recovery situations.

A separate backup for Exchange Online, OneDrive, SharePoint and Teams gives the business more control over how far back it can restore and what it can recover. The detail matters: confirm the retention period, where the backup is held, who can authorise a restore and how quickly critical data can be returned.

Test restoration before an incident happens. Restoring a single email, a folder of documents and a whole SharePoint site are different tasks. A backup that has never been tested is an assumption, not a recovery plan.

Turn staff into a useful line of defence

Most security incidents involve a human decision at some point, usually made under pressure. An employee may open a convincing attachment, approve an unexpected sign-in request or send information to an impersonator. Blaming people does not improve security. Clear, relevant training does.

Short, regular awareness sessions work better than a one-off annual presentation. Use examples that reflect the threats your team sees: false invoice requests, parcel delivery messages, payroll changes, fake document-sharing notifications and QR-code scams. Staff should know exactly how to report a suspicious message and feel comfortable doing so quickly.

Training should also reach senior leaders. Directors and partners are frequent targets because their names, roles and relationships are easy to find. The best technical controls are more effective when leaders model careful verification and follow the same rules as everyone else.

Make response and accountability part of the plan

No set of controls guarantees that an incident will never occur. What separates a contained event from a business-wide problem is the speed and quality of the response. Decide in advance who can disable an account, revoke active sessions, contact affected clients, review audit logs and approve communications.

Document the process in plain English and keep the right contact details available outside Microsoft 365. During an account compromise, the affected platform may not be the best place to store your only response instructions. Rehearsing a short scenario can reveal gaps without causing disruption.

For businesses without internal security expertise, managed support can take pressure away by monitoring alerts, administering policies and providing a real person to call when something does not look right. MSnet can help organisations choose the right mix of managed protection, technical project work and staff education without adding unnecessary complexity.

The most useful next step is often a focused review of your current Microsoft 365 setup: who has access, how accounts are protected, what data is shared externally and whether recovery genuinely works. Fixing the most meaningful gaps first gives your business one less thing to worry about while your team gets on with serving customers.

A finance manager receives a Teams message that appears to be from the managing director: a supplier’s bank details have changed, the payment is urgent, and a quick voice note confirms it. The wording is clear, the tone sounds familiar and the request fits a busy day. That is the risk posed by AI phishing. It gives criminals a faster, cheaper way to create convincing impersonation attempts that can slip past people who already know the usual warning signs.

For UK small and medium-sized businesses, this is not simply an email security issue. A successful attack can lead to fraudulent payments, exposed Microsoft 365 accounts, interrupted operations, client confidentiality concerns and difficult conversations with insurers, auditors or regulators. The practical response is to make fraud harder to execute, even when a message looks and sounds credible.

What makes AI phishing different?

Traditional phishing messages often gave themselves away. They contained obvious spelling errors, awkward phrasing, generic greetings or implausible requests. Those clues still matter, but they are no longer reliable on their own. Generative AI can produce polished, natural English in seconds, tailored to a particular industry, seniority level or business relationship.

Criminals can also use public information from company websites, social media profiles, tender notices and data breaches to make a message more believable. They may know who works in finance, which software a firm uses, where a director is travelling or the names of regular suppliers. AI helps turn those fragments into a convincing story at scale.

The result is often not a dramatic scam but a plausible request: review a shared document, re-authenticate Microsoft 365, approve an invoice, buy gift cards for a client event, or change payroll details. It arrives when the recipient is busy and is designed to encourage speed over checking.

The threat now reaches beyond email

Email remains the main route into many organisations, but it is not the only one. AI-assisted phishing can appear through Teams, WhatsApp, LinkedIn, text messages and fake support calls. A criminal may use a realistic email first, then follow up with a call or voice note that creates urgency.

Voice cloning is a particular concern. A short sample from a public video, podcast or voicemail can sometimes be enough to create an imitation. It may not withstand careful scrutiny, but a rushed employee who believes they are speaking to a director may not pause long enough to question it.

This does not mean every unusual message is AI-generated, nor that businesses should distrust every colleague. It means the old test of “does this look professionally written?” is no longer sufficient.

How AI phishing creates business risk

The immediate loss from a fraudulent payment is often the most visible consequence. However, an attacker who captures a user’s Microsoft 365 login can do far more. They may search mailboxes for invoices and bank details, set up forwarding rules, impersonate the account internally, or wait quietly for an opportunity to intercept a payment.

For professional services firms, an exposed mailbox can reveal client correspondence, personal information and commercially sensitive documents. For logistics and operational businesses, it can disrupt supplier communications, delivery arrangements and access to systems needed to keep work moving. In regulated sectors, the incident may also trigger reporting and evidence-gathering obligations.

There is a human cost too. Staff who made an honest mistake can feel embarrassed or worried about their job. A good security culture treats reporting as the right action, not an admission of failure. Early reporting gives the business a better chance of stopping account takeover or recalling a payment.

The checks that still work against AI phishing

The most effective defence is not asking staff to become forensic investigators. It is establishing a small number of clear habits that apply whenever money, credentials, personal data or urgency are involved.

First, verify requests using a separate, trusted channel. If an email asks to change bank details, call the supplier using a number already held in your records, not one in the message. If a senior colleague sends an unusual Teams request, call them on their known number or speak to them directly. Do not reply to the potentially compromised message to confirm it.

Second, make payment changes a process rather than a judgement call. A documented callback procedure, dual approval for relevant payments and clear supplier verification steps create useful friction. They may add a few minutes, but that is a sensible trade-off against the cost of a misdirected payment. The process should apply equally when the request appears to come from the owner, a long-standing client or a trusted supplier.

Third, pause before entering credentials. Microsoft 365 phishing pages can closely resemble the genuine sign-in screen. Staff should be especially cautious if they arrive there through an unexpected link, a shared-file notification or an urgent security warning. Opening Microsoft 365 through the usual bookmark or app, rather than from the message, is a simple safer habit.

Finally, report anything doubtful quickly. A suspicious message sent to the right internal contact can help protect everyone else. It also allows technical teams to check whether similar emails were delivered, whether anyone clicked, and whether accounts show signs of unauthorised access.

Technical controls that reduce the pressure on staff

Training matters, but no person will identify every well-crafted scam, particularly during a pressured working day. Technical controls should reduce the number of malicious messages that arrive and limit what an attacker can do if one gets through.

Email protection should assess links, attachments, sender identity and impersonation signals before messages reach inboxes. Domain protections such as SPF, DKIM and DMARC help reduce spoofing of your own organisation’s email domain. They are not a complete answer to lookalike domains or compromised supplier accounts, but they remain essential foundations.

Multi-factor authentication is equally important, preferably using phishing-resistant methods where appropriate. A stolen password should not be enough for a criminal to access email, cloud files or remote systems. Conditional access policies, sensible sign-in controls and prompt removal of unused accounts further reduce exposure.

It is also worth reviewing who can approve payments, create mailbox forwarding rules, register new devices and access sensitive shared folders. Least-privilege access will not stop every phishing attempt, but it limits the damage when an account is compromised. For many businesses, this is where managed oversight takes pressure away from internal teams that are already busy running the operation.

Backups are part of the picture as well. Phishing is often the first stage of ransomware or data theft. Tested backups for servers, files and Microsoft 365 data give the business more options if an attacker deletes, encrypts or alters information.

Build a response plan before an incident

When an employee suspects they have clicked a malicious link or disclosed a password, the first hour matters. Staff should know exactly who to contact and should be encouraged to act immediately, even if they are unsure. Delay is more damaging than a false alarm.

A practical incident procedure should cover who can reset passwords and revoke sessions, how to isolate a device where needed, who contacts the bank after suspected payment fraud, and how the business will communicate with affected clients or suppliers. It should also identify decision-makers who can be reached outside normal hours.

Testing the process is worthwhile. A short phishing awareness exercise can show whether people know where to report messages, while a tabletop scenario can reveal gaps in payment approvals or account recovery. The aim is not to catch staff out. It is to make the right response familiar before a real event creates pressure.

AI phishing will continue to improve because it is profitable, scalable and easy for criminals to adapt. The answer is not fear, and it is not expecting employees to spot every trick. Clear verification rules, well-managed Microsoft 365 security, layered email protection and supportive training give your team something far more useful: the confidence to stop, check and carry on with their work safely.

A remote employee signing into Microsoft 365 from a kitchen table can access the same client records, financial information and shared files as someone in the office. That flexibility is valuable, but it changes where your business is exposed. Knowing how to secure remote workers means protecting the person, the device and the account without making everyday work unnecessarily difficult.

For many UK businesses, the biggest risk is not remote working itself. It is relying on informal arrangements: personal devices with unclear ownership, passwords reused across services, files downloaded locally, or staff left to judge whether an unexpected email is genuine. The right approach brings clear controls together with practical guidance, so people can work confidently and leaders have one less thing to worry about.

Start with the risks remote work creates

Remote staff are often outside the protections of the office network. They may use home broadband, public Wi-Fi while travelling, personal printers or unmanaged devices. A secure office firewall still has value, but it cannot protect a laptop that has been compromised elsewhere or stop an employee entering credentials into a convincing phishing page.

Identity-based attacks deserve particular attention. Cybercriminals increasingly target Microsoft 365 accounts because a successful sign-in can provide access to email, files, contacts and internal conversations. From there, they can impersonate a director, alter bank details or distribute fraudulent messages from a trusted account.

There is also a continuity issue. If a laptop is lost, stolen or infected with ransomware, can the business remove access quickly? Can the employee continue working from another device? Can important files be restored without relying on a copy held only on that machine? These are operational questions as much as technical ones.

How to secure remote workers with a layered approach

No single product makes remote working safe. Effective security uses layers, so a mistake in one area does not become a business-wide incident. The controls below are a practical starting point for small and medium-sized organisations.

Secure every account, not just the office network

Multi-factor authentication should be in place for email, cloud applications, remote access and any system holding sensitive business data. A password alone is too easily stolen through phishing, credential reuse or malware. Multi-factor authentication means a stolen password is less likely to be enough for an attacker to get in.

It should be paired with sensible access rules. Staff should have access only to the systems and folders required for their role. A leaver’s accounts, devices and shared access must be removed promptly. For businesses with higher-risk roles, such as finance teams or senior leadership, additional sign-in checks and tighter controls are often justified.

Password managers can reduce the temptation to reuse passwords or keep them in spreadsheets and notebooks. They also make it easier to use long, unique credentials without expecting staff to remember them all. The trade-off is that employees need a short, clear introduction to the tool and a defined process for account recovery.

Manage the devices people use

A work laptop is not automatically secure because it belongs to the company. It needs central management, supported software, disk encryption and endpoint protection. Central management allows your IT team or provider to confirm updates are installed, apply security settings and respond if a device is lost or compromised.

Keep operating systems, browsers and commonly used applications patched. Delaying updates can be understandable when a business relies on specialist software, but this should be a managed exception rather than the default. Test updates where necessary, then apply them within an agreed timeframe.

Full-disk encryption is particularly valuable for remote staff. If a laptop is left on a train, taken from a car or misplaced during a site visit, encryption helps prevent someone else reading the data stored on it. Screen locks and short automatic timeout periods are simple safeguards that matter in shared homes and public spaces.

Bring-your-own-device arrangements need a separate decision. Some organisations can support them safely with mobile device management, containerised business apps and clear rules about what may be stored locally. Others, especially those handling confidential client, financial or regulated information, will be better served by issuing company-managed equipment. Convenience should not leave ownership and support responsibility unclear.

Protect email, browsing and everyday communication

Email remains the route into many cyber incidents. Remote workers cannot always lean across the desk to ask whether a payment request or password-reset message looks right. Email protection should therefore filter malicious attachments, suspicious links and impersonation attempts before they reach the inbox.

Internet browsing protection provides another useful layer. It can block known harmful websites and reduce the chance that a rushed click becomes a malware infection or credential theft event. It will not catch every new threat, which is why staff still need to pause and verify unexpected requests.

Set a simple verification rule for changes involving money, sensitive data or account access. For example, an emailed request to amend supplier bank details should be confirmed using a known telephone number, not a number in the email. The same principle applies to urgent requests that appear to come from a director. A quick check is far cheaper than recovering funds or explaining a data breach.

Make secure behaviour part of the working routine

Annual tick-box training is rarely enough. People are more likely to retain security guidance when it is short, relevant and repeated at useful intervals. Use examples that reflect their work: a fake document-share notification for professional services staff, a delivery update for logistics teams, or a spoofed payment approval request for finance colleagues.

Staff should know how to report something suspicious without worrying that they will be blamed for asking. Encourage early reporting of odd emails, unexpected multi-factor prompts, lost devices and accidental data sharing. A report made quickly gives the business a better chance to contain the problem.

Training should also cover physical habits. Remote workers should avoid leaving screens visible to visitors, storing work files on personal USB drives or discussing confidential matters in public places. These are not dramatic failures, but they can still create a data protection issue.

Keep business data protected and recoverable

Cloud storage improves collaboration, but it does not remove the need for backup. Files can be deleted, overwritten, encrypted by ransomware or made unavailable through a compromised account. Your business should be able to restore critical Microsoft 365 data and important server or file-share data to a known good point.

Decide where staff should save work and make that route easy. If employees must use a complicated remote connection to access documents, they may create local copies or use unapproved consumer tools instead. A well-configured cloud workspace, clear file-sharing permissions and a tested backup plan reduce this pressure.

Test restoration, not simply backup completion. A successful backup report is reassuring, but the question that matters during an incident is whether the right files can be restored quickly enough for the business to continue serving clients. Recovery objectives should reflect the cost of downtime for your organisation.

Give remote workers clear, usable rules

A remote-working security policy does not need to be a dense document that nobody reads. It should set expectations in plain English: which devices are approved, how staff connect, where files are stored, what to do if a device is lost, and who to contact when something does not look right.

The policy should distinguish between non-negotiable controls and areas where people can use judgement. Requiring multi-factor authentication and reporting a lost device immediately are non-negotiable. Whether an employee works from home, a client site or a shared workspace may depend on their role, the data involved and the privacy available.

Make the process practical by ensuring staff can get help from a real person. If security controls create friction and support is hard to reach, users will look for workarounds. Responsive IT support protects productivity as well as security.

Review access and practise your response

Security needs regular attention because staff, devices and suppliers change. Review user access periodically, especially shared mailboxes, finance systems, administrative accounts and former employees’ permissions. Dark web monitoring can also help identify exposed business credentials before criminals use them.

Prepare for the day a remote account is compromised. Your response process should cover who disables access, who checks sign-in activity, how affected colleagues are informed, when passwords are reset and how customers are contacted if necessary. A short, practised plan removes uncertainty when time matters.

For organisations without an internal IT team, managed security services can provide the oversight that otherwise falls to a busy director or operations manager. MSnet combines protective technology with practical staff education and direct human support, helping businesses apply the right level of management rather than carrying every task themselves.

Remote working should give your people flexibility, not give criminals an easier route into the business. Put sensible controls in place, explain them well and review them as the business changes. That leaves employees free to focus on good work, with the confidence that support is there when they need it.

PHP2Shell: The Website Threat Business Owners Can’t Ignore

A new critical threat has been identified, that is actively affecting business websites.

Is your website acting slow or maybe just doesn’t feel right. Are pages behaving oddly, files have changed without explanation, or your hosting provider has flagged suspicious activity.

This isn’t just a technical hiccup. It’s a business continuity incident — and it deserves immediate attention.

What is PHP2Shell and why does it matter?

PHP2Shell is a modern variant of a PHP web shell: malicious code uploaded to a web server that gives an attacker remote access. Once it’s in place, the intruder can:

Run commands on your server

Modify or replace website content

Steal data stored or processed by your site

Create new backdoors for future access

Use your hosting to send spam or malicious traffic

The real risk depends on what your website can access. A simple brochure site is one thing. A site connected to customer records, payment systems, shared storage or business email is something else entirely.

Even if your site holds no sensitive data, a defaced or offline website damages trust and interrupts enquiries — both of which cost your business time and money.

First priority: contain the incident

Deleting the suspicious file won’t fix the problem. In fact, it can make things worse by removing evidence your technical team needs.

Take these steps immediately:

Isolate the affected site if your hosting platform allows it

Contact your hosting provider and ask them to preserve logs

Reset all credentials: hosting control panel, SFTP/FTP, CMS admin accounts, database users

Change any reused passwords elsewhere

Next, your technical team needs to determine how the attacker got in.

Common causes include:

Outdated CMS platforms (WordPress, Joomla, Drupal)

Vulnerable plug-ins or themes

Weak or reused passwords

Insecure file upload functions

Compromised admin accounts

Understanding the entry point is essential — otherwise the attacker can simply return.

Recover safely and avoid reinfection

A clean backup is often the quickest way to restore your website, but it must be verified safe. Restoring an infected or outdated backup simply reopens the door.

Before bringing the site back online:

Update the server, CMS, themes and plug-ins

Remove unused plug-ins, themes and legacy code

Review user accounts and permissions

Restrict admin access using MFA or IP controls

Enable monitoring for suspicious file changes or login attempts

If your website processes personal or regulated data, you may also need to consider:

Legal reporting obligations

Regulatory notifications

Customer communication

Clear ownership protects smaller organisations

For many small and mid-sized businesses, the biggest challenge is knowing who is responsible for containment, recovery and follow-up. Without clear ownership, incidents drag on and risks multiply.

MSnet helps businesses turn a stressful compromise into a structured recovery plan — strengthening your website, your data protection posture and your team’s readiness for future threats.

A fraudulent invoice does not need to defeat a firewall to cause serious damage. It only needs to reach the right person on a busy morning, look believable and prompt a payment or password reset. That is why the best cybersecurity controls for SMEs are not simply the most technical ones. They are the practical layers that protect people, accounts, devices and business data while keeping your organisation productive.

For a UK business, the right approach should reduce the chance of disruption without creating a full-time security job for the managing director or operations team. Priorities will vary: a regulated practice may focus on confidential client information, while a logistics firm may need dependable access for mobile teams and continuous operations. The foundations, however, are remarkably consistent.

What makes a control worth the investment?

A cybersecurity control should address a realistic risk, be manageable over time and help the business recover when something goes wrong. Buying several tools with overlapping features can create cost and confusion without improving protection. Leaving powerful tools unmonitored is no better.

Start with the routes criminals use most often: email, stolen passwords, unpatched devices and access to poorly protected data. Then consider the operational impact. Could your staff work if Microsoft 365 was unavailable? Could you restore customer files after ransomware? Would a director spot a convincing request to change bank details?

The following controls provide a sensible baseline for most small and medium-sized organisations.

The best cybersecurity controls for SMEs

1. Multi-factor authentication for every important account

Multi-factor authentication, often shortened to MFA, should protect Microsoft 365, email, finance platforms, remote access, cloud storage and administrator accounts. A stolen password alone should not be enough for a criminal to sign in.

This is one of the highest-value controls an SME can introduce because credential theft remains central to phishing, business email compromise and unauthorised access. Use an authenticator app or security key where practical, rather than relying solely on text messages. Also apply stricter sign-in rules to administrator accounts, which can give an attacker much wider control.

MFA does add a small step to the working day. That trade-off is usually minor compared with the time, financial loss and reputational damage caused by an account takeover. The key is to set it up carefully and make sure staff know what unexpected prompts look like.

2. Managed email protection and clear payment checks

Email is where many attacks begin. Good email protection filters malicious attachments, suspicious links, impersonation attempts and known spam before they reach staff inboxes. It should be configured for the way your organisation works, rather than left on a generic setting that either misses threats or blocks legitimate messages.

Technology cannot guarantee that every deceptive message will be stopped. A targeted scam may imitate a supplier, a senior partner or a customer whose details have been taken from a public website. That is why process matters as much as filtering.

For changes to supplier bank details, urgent payment requests or instructions involving sensitive information, use a separate verification step. Call a known telephone number, not one supplied in the email. A two-minute check can prevent a substantial loss.

3. Endpoint protection that is actively monitored

Every laptop, desktop and server is an endpoint. These devices need more than traditional antivirus. Modern endpoint protection looks for suspicious behaviour, such as attempts to encrypt large numbers of files, run harmful scripts or disable security settings.

For SMEs, the practical question is who receives and acts on alerts. An unmanaged alert at 2am may not help if ransomware is spreading through shared folders. Managed detection and response, or a properly supported endpoint security service, gives businesses a route to containment and expert action when it matters.

Coverage must include remote workers as well as office-based staff. A home laptop connecting to company data is still part of your security position, even if it is not on the office network.

4. Patch management and secure device configuration

Attackers regularly exploit known weaknesses in operating systems, browsers, applications, firewalls and network equipment. Patching closes those gaps, but it needs a routine. Delaying all updates can leave a business exposed; installing every update instantly without testing can occasionally disrupt specialist software.

A proportionate patching process separates urgent security fixes from lower-risk updates, tests where necessary and records what has been completed. Unsupported operating systems and ageing applications need particular attention because they may no longer receive security fixes at all.

Secure configuration is the companion to patching. Remove local administrator rights where they are not needed, encrypt laptops, lock screens automatically and turn off unused services. These are quiet controls, but they reduce the damage a compromised account or lost device can cause.

5. Backups that can actually be restored

A backup is not a recovery plan unless it has been tested. Ransomware can encrypt files on servers, network storage and cloud-synchronised folders. Human error can delete important information. A backup that is connected permanently to the same environment may be affected too.

Keep protected copies of critical business data, including Microsoft 365 data where appropriate, and make sure at least one copy is isolated from the main environment. Agree how long data must be retained, who can authorise a restore and how quickly essential systems need to return.

Testing is where confidence comes from. Restore a sample of files and periodically test a larger recovery scenario. You do not need to create disruption to learn whether the process works, but you do need evidence that your data can be recovered within an acceptable timescale.

6. Password management and dark web monitoring

People reuse passwords because they have too many to remember. Criminals count on it. If a password from one compromised service is reused for business email or a cloud account, a breach elsewhere can become your problem.

A business password manager lets teams create and store long, unique passwords without resorting to spreadsheets, notebooks or shared browser profiles. It also provides a more controlled way to share access to company accounts when roles change.

Dark web monitoring can add an early warning layer by identifying exposed business email addresses or credentials. It is not a replacement for MFA or password management, and an alert does not automatically mean a live compromise. It does give the business a reason to investigate, reset passwords and check for suspicious activity before stolen credentials are used.

7. Regular, relevant security awareness training

Staff should not be treated as the weakest link. They are often the people most likely to notice a scam, report a lost device or question an unusual request. They need clear guidance that fits the risks they encounter.

Short, regular training tends to work better than an annual presentation that is quickly forgotten. Use realistic examples: a fake Microsoft 365 sign-in page, a supplier invoice with altered bank details, a QR-code scam or a caller claiming to be IT support. Phishing simulations can help identify where extra coaching is needed, provided the purpose is learning rather than catching people out.

Create a simple reporting route and respond positively when someone raises a concern. Fast reporting gives technical teams a better chance of limiting harm. It also helps build a culture where staff ask before acting, rather than feeling pressured to make a quick decision.

Put controls in the right order

Not every SME needs every control implemented at once. If budget or internal capacity is limited, begin with MFA, email protection, endpoint protection, patching and tested backups. These measures address a large share of common attacks and recovery risks.

Next, examine areas that are specific to your business. Organisations handling special category data, legal records, payment information or sensitive commercial documents may need tighter access controls, audit trails and retention policies. Businesses with field staff may need stronger mobile-device management. Companies reliant on a single line-of-business system should plan how they would operate if it failed.

It also helps to decide how each control will be delivered. A technically capable in-house team may manage some services directly. Others will be better served by a managed arrangement with named responsibility, ongoing reviews and real people available when an issue arises. MSnet’s approach is to make that choice straightforward, whether a client needs day-to-day management, targeted support or help with a defined security project.

Make cybersecurity part of business continuity

The strongest security arrangements are not built around fear. They are built around keeping the business able to serve customers, protect confidential information and meet its responsibilities when a threat occurs.

Assign ownership for key decisions, document who to contact during an incident and review your controls when staff, systems or working practices change. A practical set of well-managed controls gives leaders one less thing to worry about and gives their teams a clearer, safer way to work.

A director asks for a file from three years ago. A member of staff has deleted it, their account has since been removed, and the project folder is no longer where anyone expects it to be. This is where Microsoft 365 backup versus retention stops being an IT technicality and becomes a business continuity question.

Microsoft 365 is designed to be highly available, but availability is not the same as being able to recover every version of every item whenever your business needs it. Retention and backup can both protect data, yet they solve different problems. Treating one as a substitute for the other can leave an organisation exposed at exactly the point it needs certainty.

Microsoft 365 backup versus retention: the key difference

Retention is primarily about keeping information for a defined period, usually to meet legal, regulatory, operational or internal governance requirements. A retention policy may preserve emails, Teams messages, SharePoint documents or OneDrive files, even when a user deletes them. It helps an organisation demonstrate that required records have not been disposed of too soon.

Backup is about recoverability. A backup creates a separate copy of data so that it can be restored after accidental deletion, a malicious change, ransomware, a configuration error or another disruptive event. The focus is getting people working again with the right data, in the right location, within an acceptable timeframe.

That distinction matters. Retention answers, “How long must we keep this information?” Backup answers, “How quickly can we get it back, and where do we restore it to?” Most UK businesses with sensitive information, client records or a reliance on Microsoft 365 need an answer to both questions.

What retention does well

Microsoft 365 retention features can be very effective when they are planned properly. They can apply rules to particular users, sites, mailboxes, document types or labels, helping an organisation keep records for a set number of years and then review or delete them according to policy.

For a professional services firm, that might mean retaining client correspondence and case documents for the period set by its professional obligations. For a logistics business, it may mean preserving operational communications and records needed to resolve a dispute. For a regulated organisation, it can support evidence gathering and consistent records management.

Retention also has an important advantage: it can preserve content without relying on staff to file everything perfectly. If policy is applied to the right locations, a user deleting an email or document does not necessarily mean it is immediately gone forever.

However, retained content is not automatically simple to find or restore. Depending on how the policy is configured, content may be held in a preservation area rather than remaining available in the employee’s normal mailbox or folder structure. Recovering it can require specialist administration, eDiscovery processes or careful export work. That may be appropriate for an investigation, but it is not always the quickest route to restoring normal operations.

Retention is not a recovery plan

A retention policy can be set incorrectly, applied inconsistently or changed by an administrator. It may not cover every workload, every historic user or every location where important information lives. Licence levels and Microsoft 365 configuration also affect what is available.

More fundamentally, retention was not built as a replacement for a clean, point-in-time restore. If an entire SharePoint library is reorganised incorrectly on Friday afternoon, the business may need to return that library to the way it was at 10am, rather than search for individual retained documents one by one.

What a dedicated Microsoft 365 backup adds

A dedicated backup service takes separate, scheduled copies of selected Microsoft 365 data. This commonly includes Exchange Online mailboxes, OneDrive, SharePoint sites and Teams-related content, although coverage varies between providers and products. The detail matters, so it should be checked rather than assumed.

The practical benefit is choice. A good backup arrangement should allow authorised administrators to locate a previous version, restore a single email or file, recover a folder, or return data to its original or an alternative location. This can limit disruption when a user deletes the wrong folder, a departed employee’s content is needed, or a synchronised ransomware event damages files across a shared site.

Backup also helps create separation. Microsoft protects the underlying platform and its infrastructure, while the customer remains responsible for its data, identities, configuration and access decisions. If a compromised account deletes files or changes permissions, the issue is not that Microsoft 365 has failed. The issue is that the business needs a reliable way to reverse the damage.

That said, backup is not a magic shield. It does not prevent phishing, stop a user approving a fraudulent payment or replace strong identity controls. If an attacker has access for a long time, they may affect data before the incident is discovered. Retention periods, backup frequency, alerting and tested recovery procedures all affect the outcome.

The risks of relying on Microsoft 365 recycling alone

Microsoft 365 includes useful native recovery features, such as recycle bins and deleted-item recovery. They should be used, and they resolve many everyday mistakes. But these features have finite recovery windows, may rely on the original account or site still existing, and are not designed around your wider continuity requirements.

A 93-day SharePoint or OneDrive recovery window, for example, may sound generous until a problem is discovered after a quarterly review, a staff departure or an audit request. An organisation can also lose time working out what has happened, which version is trustworthy and who has permission to perform the recovery.

The same applies to mailbox data. Deleted-item recovery can be helpful, but it should not be the only plan for critical correspondence, shared mailboxes or the information held by senior staff. When the business needs a particular email chain to defend a decision or complete a client matter, uncertainty is expensive.

Why ransomware changes the conversation

Ransomware is often associated with servers, but cloud collaboration platforms are not immune to damage. An attacker who gains access through stolen credentials can delete, encrypt or overwrite files. A compromised device may also synchronise unwanted changes into OneDrive or SharePoint.

Version history can help in some scenarios, but it may not be sufficient for a widespread incident. Your team needs to know which data was affected, how far back to recover it, whether permissions have changed and whether restored files are safe to put back into use. A separate backup gives recovery options without relying entirely on the affected live environment.

This is why backup should sit alongside, not instead of, multi-factor authentication, endpoint protection, email security, least-privilege access and staff awareness training. The aim is not to assume people will make mistakes. It is to make sure one mistake does not become a business-stopping event.

When you need retention, backup or both

There are a few cases where the answer is clearer. If your main concern is complying with a documented requirement to preserve records for a defined period, retention is essential. If your main concern is fast restoration after deletion or corruption, backup is essential.

In most SMEs, however, the answer is both. Retention supports accountable information management. Backup supports recovery and continuity. They overlap in places, but the overlap should be treated as additional protection, not proof that either requirement has been fully met.

A sensible approach starts with the consequences of loss. Ask which Microsoft 365 data would stop work if it disappeared, what records must be retained, how long a team could operate without them, and who has authority to restore them. Consider former employees too. Their mailboxes and OneDrive data can hold valuable business records, but are often overlooked during offboarding.

Set recovery expectations before an incident

Your recovery plan should state how often backups run, how long copies are kept, which services are included and how quickly critical data should be restored. These are business decisions as much as technical ones. A firm handling confidential client work may need different recovery targets from a company using Microsoft 365 mainly for internal collaboration.

It is also worth testing restoration. A backup that has never been tested is an assumption, not a plan. Test a file-level recovery, a mailbox item and a SharePoint folder. Confirm who performs the work, how access is approved and how users are told that their data has been restored.

Make the policy match the way your business works

The best setup is rarely the most complicated one. It is the one that covers the data your people rely on, reflects your regulatory and contractual duties, and can be managed without adding pressure to an already busy leadership team.

For some businesses, a technically capable internal team may manage policies and backup checks themselves. Others benefit from a managed service, particularly where there is no dedicated IT function or where leaders need clear accountability during an incident. MSnet can help businesses assess their Microsoft 365 protection, put sensible controls in place and provide real human support when decisions need to be made.

Retention keeps the records you are required to hold. Backup gives you a practical route back when something goes wrong. Putting both in place means a deleted file, compromised account or unexpected staff departure becomes a manageable task, rather than one more thing to worry about.

A convincing invoice, a Microsoft 365 password alert or an urgent request from a director can reach an employee between meetings and be acted on in seconds. That is why learning how to prevent phishing emails is not simply an IT task. It is a practical part of protecting cashflow, confidential data, client trust and the ability to keep operating normally.

Phishing has moved well beyond poorly written messages from unfamiliar senders. Criminals now copy supplier branding, imitate senior colleagues and use compromised accounts to send messages from genuine-looking addresses. For small and medium-sized businesses, the most effective response combines technical protection with clear, repeatable staff habits. Neither works as well on its own.

Why phishing remains a business risk

Phishing emails are designed to make people do one of three things: disclose a password, open a harmful attachment or make a payment. A successful attack may give a criminal access to Microsoft 365, payroll records, customer information or financial systems. In some cases, the first email is only the starting point for a wider ransomware or business email compromise incident.

The commercial impact can be immediate. A fraudulent payment may be difficult to recover; a compromised account can send further phishing emails to customers and suppliers; and downtime can disrupt delivery, billing or client service. Regulated organisations also need to consider their responsibilities for personal and sensitive information.

The challenge is that a phishing email does not always look suspicious at first glance. Staff are busy, suppliers change bank details legitimately, and messages from cloud services can be frequent. Your controls need to account for real working conditions, rather than expecting every employee to spot every threat perfectly.

How to prevent phishing emails with layered protection

There is no single setting that stops all phishing. The sensible approach is to build layers, so that if one control is bypassed, another limits the damage.

Filter malicious messages before they reach inboxes

Email protection should scan incoming messages for malicious links, attachments, spoofed senders and known phishing techniques. It should also examine messages sent internally, because a compromised colleague’s account can be especially convincing.

For organisations using Microsoft 365, security settings should be configured for the way your business actually works. Overly strict filtering can delay legitimate supplier emails, while loose settings leave staff exposed. The aim is not to block every unusual message. It is to reduce the number of dangerous messages that employees ever need to assess.

Domain protection is also worth addressing. Properly configured email authentication helps receiving systems check whether a message claiming to come from your domain is genuine. This reduces the chance of criminals impersonating your business to target customers, suppliers or your own staff.

Make stolen passwords less useful

A password entered on a fake sign-in page can give an attacker a route into an account within minutes. Multi-factor authentication, ideally using an authenticator app or security key, makes that stolen password far less valuable.

It is not a complete answer. Criminals may use fake sign-in pages that request a multi-factor approval, or steal session information from an infected device. However, multi-factor authentication remains one of the strongest practical safeguards against routine account takeover. It should be enabled for email, finance systems, remote access and any application holding sensitive business information.

Strong, unique passwords matter too. A credential manager helps staff use them without resorting to reused passwords, notebooks or predictable variations. If a password is exposed in an unrelated breach, reuse can turn one incident into access across several business services.

Secure the devices people use to read email

Phishing does not only target inboxes. A harmful attachment or link can attempt to install malware on the device that opens it. Managed endpoint protection, prompt security updates and controlled software installation reduce that risk.

Web browsing protection adds another useful layer by blocking known malicious websites, including fake Microsoft 365 sign-in pages. This matters when an email slips through filtering or when an employee receives a phishing link through a messaging platform rather than email.

For remote and hybrid teams, make sure the same protections apply outside the office. A home laptop, personal mobile device or unmanaged computer can become the weak point if it accesses company email without suitable controls.

Give staff a simple way to spot phishing

Training works best when it is practical, brief and repeated. A yearly presentation may satisfy a policy requirement, but it will not prepare someone for a credible email received late on a Friday afternoon. Staff need examples that reflect their roles, such as invoice fraud for accounts teams, document-sharing requests for professional services or delivery-related messages for operational teams.

Encourage employees to pause when a message creates urgency, secrecy or pressure. They should check the sender address carefully, inspect unexpected links before opening them and be cautious with attachments they were not expecting. A polished logo or familiar name is not proof that an email is safe.

The following warning signs should prompt a second check:

• a request to reset a password or approve multi-factor authentication that the recipient did not initiate;
• changed bank details, especially where payment is requested urgently;
• unexpected shared files, invoices or scanned documents;
• messages that move a conversation away from normal approval processes; and
• small changes in an email address, spelling or domain name.

These signs are useful, but context matters. A genuine supplier may send an unexpected invoice. The right response is not necessarily to ignore it, but to verify it through a trusted route, such as a known telephone number or an existing contact record. Do not use the contact details in the suspicious email itself.

Make reporting easy and blame-free

Employees should know exactly what to do when they are unsure. A clear reporting button or a designated address can help, but the culture around it matters just as much. People must feel comfortable reporting a suspicious message, even if they clicked a link or entered details.

Treating reports as a learning opportunity allows your IT team or managed provider to investigate quickly, remove similar emails from other inboxes and reset credentials where needed. Blame and embarrassment encourage silence, which gives an attacker more time.

Protect high-risk processes outside the inbox

Many phishing attacks succeed because an email triggers a weak business process, not because technology failed. Payment changes, new payees and requests to release funds should require independent verification and clear approval steps. A request apparently from a director should not override established controls simply because it sounds urgent.

The same principle applies to access requests. No member of staff should add a new administrator, share confidential files externally or disclose client information on the basis of an emailed instruction alone. For sensitive actions, use a separate channel to confirm identity.

Senior leaders and finance staff often receive the most carefully targeted messages. They need the same training and protections as everyone else, alongside procedures that make it acceptable to challenge a request from a colleague or partner.

Know what to do if someone clicks

Speed matters after a suspected phishing incident. Staff should report it immediately, disconnect a device from the network if malware is suspected, and avoid deleting the message before it can be checked. If credentials were entered, reset the password through a known route and review active sessions and multi-factor settings promptly.

Your incident process should identify who investigates, who communicates with affected customers or suppliers if required, and when to involve specialist support. Keep this process proportionate to your organisation, but test it occasionally. A plan that exists only in a policy folder rarely helps when people are under pressure.

Reliable backups are part of resilience too. They will not stop a phishing email, but they can reduce disruption if an attack leads to ransomware or data loss. Backups should be protected, monitored and tested for restoration, not simply assumed to be available.

Turn phishing prevention into routine business practice

The best phishing defences are visible in everyday behaviour: staff pause before acting, systems challenge suspicious activity, and leaders support verification rather than rushing decisions. Review your email security, account protection and payment processes as your business changes, particularly when introducing new cloud tools, suppliers or remote-working arrangements.

For businesses without in-house security expertise, a managed approach can take pressure away from busy leaders. MSnet can help combine email and endpoint protection with practical awareness training and responsive human support, so protection is maintained rather than left as a one-off project.

A suspicious email will eventually reach someone in your organisation. The goal is to make sure that one click, one rushed reply or one convincing impersonation does not become a business-critical event.

A ransomware message on a Monday morning, a flooded comms room, a Microsoft 365 access issue or the sudden absence of a key supplier can stop work far faster than most businesses expect. The purpose of a business continuity planning guide is not to predict every possible event. It is to make sure your people know what matters most, who makes decisions and how the business keeps serving customers when normal operations are disrupted.

For UK SMEs, continuity is often personal. A few hours without access to client files can delay a property completion, interrupt a logistics schedule or leave a professional services team unable to meet a regulatory deadline. A practical plan reduces uncertainty at the point when leadership teams have the least time to think.

What business continuity planning really covers

Business continuity planning sets out how your organisation will maintain critical activities during a disruption and recover them within an acceptable time. It covers more than IT, although technology is usually central to delivery. People, premises, suppliers, communications, records and decision-making all belong in the plan.

It is useful to separate business continuity from disaster recovery. Disaster recovery is the technical work of restoring systems, data and infrastructure after an incident. Business continuity is broader: it includes the temporary workarounds that let the business function while recovery is under way. If your finance system is unavailable, for example, disaster recovery restores it. Continuity may mean agreeing a secure, temporary process for approving urgent payments and communicating realistic timescales to suppliers.

A plan does not need to be a large document that only gets opened after something goes wrong. For many SMEs, a concise, well-tested plan with clear ownership is more valuable than a lengthy policy full of assumptions.

Start with the services your customers cannot lose

The strongest plans begin with a business impact analysis. This means identifying the activities that must continue, the resources they need and the consequences if they stop. Start from the customer promise, rather than from a list of servers or software licences.

Ask each department what would happen if its main systems, information, workplace or key people were unavailable for four hours, one day and one week. The answers often expose dependencies that are easy to miss in day-to-day operations. A team may be able to work from home, for instance, but only if staff have managed devices, multi-factor authentication, current contact details and access to the correct cloud folders.

For each critical activity, document two targets:

• Recovery time objective (RTO): how quickly the activity must be restored before the impact becomes unacceptable.
• Recovery point objective (RPO): how much data loss is tolerable, measured in time.

These figures should reflect commercial reality. A one-hour RTO and a near-zero RPO may be appropriate for a business handling time-sensitive transactions, but they cost more to deliver than overnight recovery from a daily backup. There is no universal right answer. The sensible choice balances customer commitments, contractual duties, cashflow, compliance and budget.

Build a plan people can use under pressure

Once priorities are clear, turn them into practical actions. Write for the person dealing with the incident at 7.30am, not for an auditor reading a policy six months later. Plain language, named owners and up-to-date contact information matter more than technical jargon.

Your plan should establish who can declare an incident, who leads the response and who can authorise spending or customer communications. It should also identify a deputy for each role. A plan that relies on one director, one IT manager or one administrator is vulnerable from the outset.

Create an incident response playbook

A cyber incident needs fast decisions. If a staff member reports a suspicious login, a ransom note or an unexpected payment request, people should know how to escalate it immediately. The first priority may be to isolate a device or suspend an account, not to investigate it alone.

Include a simple process for recording what happened, when it was discovered, which systems may be affected and what action has been taken. Preserve evidence where possible, but do not let evidence gathering delay containment. Your IT provider, cyber insurer, legal adviser and any relevant regulator may all need accurate information later.

This is also where staff awareness supports continuity. Phishing and business email compromise frequently start with a believable message, not a sophisticated technical attack. Regular, targeted training gives employees permission to pause, report and ask for help before a small mistake becomes an operational crisis.

Plan communications before you need them

Silence creates uncertainty for staff and customers alike. Prepare a short list of audiences: employees, customers, suppliers, insurers, regulators, landlords and key partners. Decide who communicates with each group and what information can be shared at different stages of an incident.

You do not need pre-written statements for every scenario. You do need agreed principles: be accurate, avoid speculation, say what services are affected, explain the next update point and give people a reliable contact route. If your email is unavailable, how will you send that message? A continuity plan should include alternative contact methods and an accessible list of important numbers.

Protect the technology that supports recovery

Backups are fundamental, but they are not the whole answer. A backup that has never been tested may fail when it is needed most. Recovery also depends on clean systems, secure identities, documented configurations and people who can access the recovery tools.

Use layered protection around the most common routes into an SME: email, employee credentials, endpoints and internet browsing. Multi-factor authentication, managed endpoint protection, email filtering, patching and least-privilege access can reduce the chance that an incident becomes widespread. Dark web monitoring and credential management can also help identify exposed passwords before criminals use them.

For backup, consider the 3-2-1 principle: keep at least three copies of important data, on two different types of storage, with one copy held separately from your main environment. The exact design depends on your systems and recovery targets. Cloud backup can be highly effective, but only if you understand what is being protected, how long versions are retained and whether Microsoft 365 data is independently recoverable.

Test restoration at the level that matters to the business. Restoring a single file is useful, but it does not prove that an entire finance application, server or Microsoft 365 environment can be recovered within its RTO. Record the result, the time taken and any missing steps. Those findings are not failures – they are the work that makes the plan credible.

Include suppliers, premises and manual workarounds

Many continuity plans focus heavily on internal IT and overlook external dependencies. Consider the suppliers whose failure would prevent you from trading: internet and telephony providers, payment processors, cloud platforms, outsourced payroll, specialist software vendors and delivery partners. Keep account references, support routes and escalation contacts somewhere secure but accessible outside the affected system.

Premises still matter, even for organisations with hybrid working. A power failure, fire alarm, flood or transport disruption may make an office inaccessible. Decide whether staff can work remotely, whether they have suitable devices and whether sensitive information can be handled safely away from the office. For some teams, a small number of pre-approved alternative workspaces may be more realistic than expecting everyone to work from home.

Manual workarounds should be controlled, especially where personal, financial or regulated information is involved. Paper notes, personal email accounts and informal messaging groups can create a second problem if used without safeguards. Set out what temporary processes are permitted, how records will be protected and how they will be reconciled once systems return.

Test, improve and keep ownership clear

A business continuity planning guide only becomes useful when it is tested. Begin with a short tabletop exercise: give the leadership team a realistic scenario, such as a ransomware attack that has encrypted a shared drive, and ask what happens in the first hour, first day and first week. The gaps will become clear quickly.

Then test selected technical and operational procedures. This could include recovering a sample of backed-up data, working from an alternative location, using an emergency communications list or responding to a simulated phishing report. Avoid tests that create unnecessary risk to live operations, but do not make them so gentle that they prove nothing.

Review the plan after every exercise, significant incident or material change. New software, office moves, acquisitions, changes to suppliers and staff turnover can all make an old plan inaccurate. Assign a named owner, set a review date and make continuity a standing item in leadership or risk meetings.

For organisations without in-house expertise, managed IT and cybersecurity support can take pressure away by maintaining protection, monitoring risks and helping test recovery arrangements. MSnet can support businesses that need ongoing management as well as those looking for focused continuity and recovery advice.

The best time to find a missing backup, an unclear responsibility or an out-of-date phone number is during a calm, planned exercise. A clear plan gives your people confidence to act, protects the service your customers rely on and leaves business leaders with one less thing to worry about.