Phishing Protection for UK Businesses: Controls That Actually Work

The Phishing Threat in 2025

Phishing has evolved significantly from the obviously fraudulent emails of the early 2000s. Modern phishing campaigns are personalised, visually convincing and increasingly generated with AI assistance. The NCSC's 2024 Cyber Security Breaches Survey found that phishing was the most common type of attack among UK businesses that identified a cyber incident, cited by 84% of affected organisations.

The consequences of a successful phishing attack range from account compromise (often leading to business email compromise or data exfiltration) to ransomware deployment, with an average UK data breach cost of £3.4 million in 2024 inclusive of recovery, notification and business interruption costs. For SMEs, a single significant phishing incident can be existential.

Email Authentication: SPF, DKIM and DMARC

Email authentication protocols prevent attackers from sending emails that impersonate your domain. They are the foundational technical control against phishing and should be in place before any other anti-phishing measure is added.

SPF (Sender Policy Framework)

SPF is a DNS record that specifies which mail servers are authorised to send email from your domain. When a recipient's mail server receives an email claiming to be from your domain, it checks the SPF record to verify whether the sending server is authorised. Unauthorised senders fail the SPF check.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to emails sent from your domain, allowing recipients to verify that the message was not altered in transit and that it genuinely came from an authorised sender. The DKIM signature is verified against a public key published in your DNS.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC builds on SPF and DKIM by specifying what to do with emails that fail authentication checks — quarantine them, reject them or pass them through — and generates reports allowing you to monitor your domain's email authentication health. A DMARC policy of p=reject instructs receiving mail servers to reject emails that fail SPF and DKIM checks, effectively blocking domain spoofing.

NCSC's Mail Check tool provides a free assessment of your domain's email security configuration including DMARC, SPF and DKIM status.

Anti-Phishing Email Filtering

Beyond authentication, inbound email filtering provides several layers of protection:

• Link scanning: URLs in emails are checked against reputation databases and in some cases detonated in a sandbox before the email reaches the inbox. Safe Links (Microsoft Defender for Office 365) rewrites URLs and checks them at click-time, providing protection even when phishing URLs are not yet in reputation databases at delivery time.
• Attachment sandboxing: Email attachments are opened in an isolated sandbox environment to detect malicious behaviour before delivery. Microsoft Defender's Safe Attachments and similar third-party tools fulfil this role.
• AI-based impersonation detection: Machine learning models analyse email metadata, content and sender behaviour patterns to identify impersonation attacks — even when the sender has a legitimate-looking address that passes SPF/DKIM/DMARC checks.
• Lookalike domain detection: Filters identify emails from domains visually similar to your trusted partners (amv1a.co.uk vs amvia.co.uk) that attackers register to impersonate correspondents.

Microsoft 365 Anti-Phishing Controls

For businesses using Microsoft 365, Defender for Office 365 (Plan 1, included in Business Premium) provides:

• Safe Links — time-of-click URL checking
• Safe Attachments — sandboxed attachment detonation
• Anti-impersonation policies — protection against spoofed sender display names
• Anti-spoofing — blocks emails that fail authentication checks
• Phishing simulation capability — for staff training (covered below)

The anti-phishing policies in Defender for Office 365 require configuration — the defaults are not the most protective settings. AMVIA includes Microsoft 365 security hardening in all its managed service packages, ensuring these policies are correctly configured and monitored.

Security Awareness Training and Phishing Simulation

Technical controls significantly reduce phishing exposure but cannot eliminate it entirely — particularly against sophisticated targeted attacks. Security awareness training remains important, with some important caveats about how it is delivered:

• Regular short sessions work better than annual compliance exercises: Monthly 5-minute microlearning modules embed awareness more effectively than a 45-minute annual training video that employees click through to get the completion badge.
• Phishing simulation testing identifies vulnerability without blame: Sending simulated phishing emails to staff and tracking click rates provides objective data on susceptibility. Employees who click should receive immediate, constructive education — not punishment.
• Train on current threat patterns: Training that shows 2010-era phishing indicators trains staff to spot outdated attack patterns. Simulations and training should reflect current techniques including AI-personalised lures, QR code phishing and voice phishing (vishing).
• Create a reporting culture: Staff who believe they may have clicked on a phishing link or submitted credentials somewhere suspicious should feel safe reporting it immediately. Early reporting enables rapid response. Punitive cultures suppress reporting.

Incident Response for Phishing

If a phishing attack succeeds — an employee clicks a link, enters credentials or opens a malicious attachment — your response speed determines the damage:

1. Reset the compromised account password and revoke active sessions immediately
2. Enable MFA if not already active (and review why it was not)
3. Review Microsoft 365 audit logs or your SIEM for any actions taken under the compromised account
4. Check for email forwarding rules created by the attacker
5. Notify other staff if the compromised account was used to send further phishing emails internally or to contacts
6. Assess whether any personal data was accessed — UK GDPR breach assessment required