Best ways to combat phishing in companies
An email from the "CEO" asking for a quick bank transfer. A login page that looks like Microsoft 365. A notification from a partner with an invoice that needs to be paid immediately. These are no longer obvious scams with poor wording. Phishing has become a targeted attack method against companies, and the best ways to combat phishing rely on more than one defence.
The attacker often only needs a moment's attention from one employee to obtain passwords, payment details, or access to sensitive data. The company, however, needs to have the right processes, technology, and responses in place every day. This is far more cost-effective than dealing with fraud, data loss, or operational downtime afterwards.
Why phishing is so often successful
Phishing is primarily about exploiting trust and speed. The messages can come from an email address that resembles that of a supplier, bank, or manager. They can refer to a real project, a recent customer, or public information that the attacker found on the company's website or social media.
The goal is usually one of three: to get the recipient to log in to a fake page, open a malicious attachment, or make a payment. In many cases, the initial message does not contain malicious software. Access to a single email can be enough for the attacker to monitor communications, send credible messages from within the inbox, and find the next step.
Therefore, it is not fair to place all the responsibility on staff. A good employee can make the wrong decision when messages look convincing, time pressure is high, and procedures are unclear. Companies need defences that make mistakes less consequential.
Best ways to combat phishing start with clear processes
Secure operations are not built on staff constantly being suspicious. They are built on certain actions never being performed solely based on an email. Payments, changes to supplier bank details, new payees, and requests for confidential data always require confirmation via another channel.
That confirmation could be a phone call to a known number, a request in an approved work order system, or a face-to-face conversation. It is important not to use the phone number or link provided in the suspicious message. If the attacker controls the communication channel, the confirmation is worthless.
Managers need to support these work practices in practice. An employee who stops a payment to verify a request should be praised, not reprimanded for slowing down the process. When speed is the only metric, a fraudster is more likely to win.
Teach staff to recognise context, not just errors
Anti-phishing training should not be an annual mandatory course that is forgotten the next day. It needs to be linked to the messages and decisions people make in their work. For example, a finance team needs to practice requests for payment changes, while sales and service teams need to recognise fake login links and unexpected document requests from a customer.
Good training teaches people to pause when a message creates an unusually urgent situation, asks for secrecy, or requests that normal processes be bypassed. It also teaches a simple response: don't click, don't reply, report immediately. Staff should know exactly where to go without fear of appearing insecure.
Phishing simulations can be useful, but only if they are used for improvement. The goal is not to trap people but to identify where procedures, training, or technical defences fail. Frequent, short training sessions are usually more effective than one long presentation once a year.
Protect identities with multi-factor authentication and password management
Stolen passwords are still one of the most common ways into company systems. Multi-factor authentication significantly reduces the risk because a password alone is not sufficient for login. However, it must be configured correctly and cover email, cloud services, remote access, administrator access, and other systems that store or open sensitive data.
Not all multi-factor authentication is equally strong. SMS codes are better than nothing, but can be vulnerable to fraud and SIM swapping. Authenticator apps, security keys, and phishing-resistant login methods provide stronger protection where applicable. The right choice depends on the company's systems, risks, and work environment.
Password managers help staff use long, unique passwords without storing them in documents, browsers, or notes. They can also reduce the risk of fake login pages, as correctly saved credentials will not be automatically filled into the wrong website. It must also be defined who has access to shared accounts and what happens when an employee changes roles or leaves.
Strengthen email before messages arrive
Email protection should stop as much as possible before an employee sees the message. Spam and threat filters, analysis of malicious attachments and links, along with rules for spoofing the company's domain, are the foundation of protection. Correct SPF, DKIM, and DMARC settings also help prevent the company's name from being used to deceive customers or partners.
However, technical defences cannot guarantee that nothing will get through. New attacks and tailored scams can bypass filters, especially if the attacker uses a real email account they have taken over. Therefore, email defences, user training, and payment processes need to work together.
It is also important to limit which applications can run from attachments and which users have administrator privileges. If a suspicious document leads to an infection on one computer, the device should not automatically be able to spread the attack across the entire network. Endpoint protection, regular updates, and access segmentation reduce the scope of damage when something goes wrong.
Have a simple process for when someone clicks
Despite good defences, incidents will occur. The difference between a minor incident and a serious security breach is often determined by the first few hours. An employee who enters a password on a suspicious page needs to be able to report it immediately. Then the password needs to be changed, active login sessions revoked, login history reviewed, and it needs to be assessed whether the mailbox has been used for further fraud.
If an attachment was opened or an application run, the device needs to be isolated, investigated, and it must be confirmed that the attack has not reached other systems. If there is a potential payment fraud, the finance team must contact the bank and the relevant counterparty without delay. Delays can be decisive in whether a transfer can be stopped.
A response plan does not need to be a thick report that no one opens. It needs to tell people who makes decisions, who is informed, which systems to protect first, and how operations are kept running. Test it regularly, especially when new systems, new employees, or new payment methods are introduced.
Phishing protection is operational protection
The cost of phishing is rarely just technical. It manifests as lost work hours, halted projects, incorrect payments, damaged services, and trust that takes a long time to rebuild. For small and medium-sized businesses, one serious incident can divert attention from operations for many weeks.
At nexIT, we therefore view phishing protection as an interplay of daily system management, correct security settings, and accessible advice when something seems wrong. You should not have to hire a specialist every time an employee receives a suspicious message.
Start with one realistic question: If someone in the company clicks on a convincingly fake link today, do we know exactly what happens next? If the answer is not clear, it is a good place to improve defences before an attacker tests them for you.
