Email remains the main route for phishing, malware, and fraud. No single tool stops everything, so use layers.

Layer 1: Filtering

A secure email gateway or built-in protection (such as Microsoft Defender for Office 365) scans incoming mail for:

– Spam and bulk mail

– Malicious attachments (using sandboxing)

– Dangerous links (checked when clicked, not just when delivered)

– Impersonation of executives or trusted brands

Layer 2: Authentication

Set up SPF, DKIM, and DMARC on your domain to prevent others from spoofing your address.

Layer 3: Account protection

– Enforce MFA

– Block legacy authentication

– Monitor for suspicious forwarding rules and unusual sign-ins

Layer 4: Policies and configuration

– Warn users about external senders

– Block risky file types

– Restrict automatic forwarding to external addresses

– Quarantine suspicious messages for review

Layer 5: People

– Security awareness training

– A simple, well-known way to report suspicious email (such as a “Report phishing” button)

– Regular phishing simulations

Layer 6: Response

Know how to pull a malicious email from every mailbox, reset compromised accounts, and notify affected parties.

Business email compromise

The costliest attacks often contain no malware at all, just a convincing request to change a bank account or pay an urgent invoice. Verify payment changes by phone, using a number you already trust.

Review regularly

Check quarantine settings, blocked messages, and reports monthly.

DBR Soft provides email security and awareness training. Ask about an email security review. Contact us for more information.