Phishing is on the rise: how to protect your team
Phishing messages have become professional and increasingly target SMEs. We cover the current state, five layers of protection and concrete steps your team can adopt within a week.
Phishing remains the most common way attackers gain access to company systems. According to Verizon's 'Data Breach Investigations Report 2024', the human element was involved in 68 percent of all breaches, and the majority of these started with phishing or social engineering. The ENISA Threat Landscape report (ENISA, 2024) lists phishing as the principal initial access vector for both ransomware and account takeover.
For small and medium-sized companies the situation is challenging for two reasons. First, messages are no longer typo-ridden generic scams but targeted, well-written and tailored to your specific context. Second, SMEs do not have a dedicated security team to vet suspicious messages on others' behalf — the responsibility is distributed across every employee.
What has changed in recent years
Generative AI has eliminated the classic tells of phishing messages. Previously, suspicion was raised by grammar errors, awkward phrasing and generic salutations. Today an attacker can automatically produce a flawless message that looks like it came from a legitimate supplier or colleague.
The second major change is the rise of business email compromise. The attacker first breaks into a single mailbox, follows ongoing conversations and then sends a well-timed message as a continuation of a real thread — for example, asking to transfer an invoice payment to a new account. Microsoft's 'Digital Defense Report' (Microsoft, 2024) reports that BEC cases have grown sharply in the SME segment.
Five layers of protection
Effective protection does not rest on a single tool. It is a combination of five layers, each of which stops a portion of attacks. The more layers, the less your organisation's safety depends on a single click.
- Technical filtering — Microsoft Defender for Office 365 or equivalent email filter blocks known scams before they reach the mailbox
- Domain authentication — SPF, DKIM and DMARC records prevent attackers from sending mail in your domain's name
- Access management — multi-factor authentication (MFA) and Conditional Access prevent account takeover even if the password is exposed
- User training — regular practice with realistic but safe phishing simulations, not just written guidance
- Incident process — a clear, documented response when someone reports or clicks a suspicious message
User training is the most important investment
Even with improved technical filtering, some messages always get through. The user is the last line of defence — and they must be set up to succeed. Studies (e.g. KnowBe4 'Phishing by Industry Benchmarking Report', 2024) show that without training, around 32 percent of users click a well-crafted phishing message. With regular training the figure typically drops below 5 percent within 12 months.
The most effective method is simulation training: the company sends safe, harmless phishing messages itself and provides immediate feedback to those who click. This is not punishment but a learning opportunity. Combined with short (5–10 min) internal training modules, this builds a team reflex: when in doubt, verify, do not click.
- Monthly simulated messages — varied themes (calendar invite, invoice, M365 verification, executive request)
- Immediate feedback to clickers: a brief explanation of the warning signs
- Annual full-team training (30–60 min) on current threats
- Clear reporting path: a single button or email address for forwarding suspicious messages
When someone clicks — act like this
Human errors happen, and the priority is to limit damage. A well-prepared response process can reduce a breach's impact to a fraction of what unfolds in chaos where nobody knows whom to notify.
The practical minimum is to document: who receives the report, what is done in the first 30 minutes (account lockdown, password change, session revocation), and when the customer or authority must be informed. Entities under NIS2 are required to notify a significant incident to the authority within 24 hours.
- Lock the user account and revoke active sessions
- Change the password and force MFA re-registration
- Review sent messages and inbox rules (attackers often install automatic forwarding rules)
- Check sign-in logs for unusual IPs and geographical locations
- Document the incident and notify the authority where required (Cybersecurity Centre, NIS2-obligated entities)
Frequently asked questions
Want to strengthen your team's phishing protection?
We help build layered protection in Microsoft 365, configure domain authentication records and launch ongoing simulation training for your team.
Get in touch