Room4.04Floor 4 Security and backup
Email security and phishing protection for business
We harden Microsoft 365 email so phishing is caught before the inbox, nobody can send mail pretending to be your domain, a stolen password is not enough to get in, and staff can spot the messages that slip through.
- Phishing caught before the inbox
- No spoofing of your own domain
- SPF, DKIM and DMARC enforced
- Staff trained on real examples
Most attacks on small businesses start with one email
Ransomware gets the headlines, but the attack that costs GTA businesses the most money is quieter. Someone signs in to a fake Microsoft page, an attacker reads their mailbox for a week, and then a perfectly ordinary-looking invoice goes out with new banking details.
The payment is real, it leaves on time, and nobody notices until the supplier calls asking where their money is.
Email security is not one product. It is a set of layers, each catching what the one before missed: filtering that stops most phishing before it arrives, sign-in rules that make a stolen password useless, records that stop anyone sending mail as your domain, and people who know what a suspicious request looks like. Most Microsoft 365 tenants we look at have the first layer switched on and very little of the rest.
We set up all of it, inside the Microsoft 365 you already pay for wherever possible, for offices across Toronto, Mississauga, Vaughan and Oakville.
How a business email compromise actually unfolds
This pattern repeats with only small variations. Every stage has a control that would have stopped it, and those controls are what the rest of this page is about.
Day 1: a convincing sign-in page
An email about a shared document or a voicemail leads to a page that looks exactly like the Microsoft sign-in. Modern phishing kits sit between the user and the real Microsoft page, passing the password and the multi-factor code through and keeping the session that comes back. Ordinary text-message and app codes do not stop this.
Days 2 to 10: reading quietly
The attacker signs in from their own laptop, reads recent invoices and payment threads, and creates an inbox rule that moves any reply from the accounting contact into a folder nobody checks.
Day 11: the invoice
A message goes out from the real mailbox, or from a lookalike domain one letter off, with an updated invoice and new banking details. It is written in the right tone, replies to a real thread and arrives just before a payment run.
Weeks later: the phone call
The real supplier asks about a missed payment. By then the money has moved on, the mailbox has been used to phish your clients too, and you may have a privacy breach to assess under PIPEDA.
The protection layers we set up
Each layer below is matched to the Microsoft 365 licence that includes it, so you can see what you already own and what an upgrade would add.
| Layer | What it stops | Where it comes from |
|---|---|---|
| Anti-spam and anti-malware filtering, tuned | Bulk phishing and known malware, with policies tightened past Microsoft’s defaults | Every Microsoft 365 business plan |
| Safe Links and Safe Attachments | Links checked again at the moment they are clicked, and attachments opened in a sandbox first | Business Premium, through Defender for Office 365 Plan 1, with link checking also added to Basic and Standard in 2026 |
| Impersonation protection | Mail pretending to be your owner, your finance lead or your own domain, including lookalike spellings | Business Premium |
| Phishing-resistant sign-in | Stolen sessions from fake sign-in pages, using passkeys, Windows Hello and rules that require a company device | Business Premium, through Entra ID P1 and Intune |
| Alerts on forwarding and inbox rules | The quiet rule an attacker sets up to hide replies, and mail forwarded outside the company | Every plan, with alerting we configure |
| Direct Send locked down | Spoofed mail that appears to come from inside your own company | Every plan, as a setting we switch on after checking your devices |
| External sender tags and blocked file types | Staff mistaking outside mail for internal, and attachment types that are almost always malicious | Every plan |
| A report phishing button | Suspicious mail reported in one click, so one person’s catch protects everyone | Every plan |
The sign-in layer matters most against the attack described above, because it stops a stolen session from being used even when the person has typed their password into a fake page. Our Intune and cybersecurity pages cover the device and endpoint side of it.
SPF, DKIM and DMARC, in plain terms
These three DNS records decide whether the rest of the internet believes mail that claims to come from your domain. Without them, anyone can send an email from accounts@yourcompany.ca to your clients, and it will often be delivered.
| Record | What it says | What usually goes wrong |
|---|---|---|
| SPF | Which servers are allowed to send mail for your domain | Services added over the years until the record breaks its lookup limit and stops working |
| DKIM | A signature on each message proving it was not altered and came from an approved sender | Switched on for Microsoft 365 but not for the newsletter tool, the CRM or the accounting software |
| DMARC | What receivers should do with mail that fails the other two, and where to send reports | Left at monitoring only for years, so it reports spoofing but never stops it |
Getting to full protection is a staged job. We first list every service that sends mail as your domain, such as your website forms, accounting package, CRM, newsletter tool and scanners. Then DMARC runs in monitoring mode while we read the reports and fix each sender. Only then does the policy move to quarantine and finally reject, at which point mail forged in your name stops being delivered.
This also matters for your own deliverability. Gmail and Yahoo have required authentication from bulk senders since 2024, and Microsoft’s Outlook.com followed in 2025, so a domain without these records increasingly sees its legitimate mail land in spam.
Direct Send: the setting most tenants still leave open
Exchange Online has long accepted mail sent straight to your mailboxes, without any sign-in, as long as it claims to come from your own domain and is addressed to your own people.
It exists so that copiers and older applications can email staff. Since 2025, attackers have used it widely to send phishing that appears to come from a colleague, and it can slip past filters that treat internal mail as trusted.
Microsoft added a setting in 2025 to reject this kind of mail and has said that new tenants will have it switched on. Older tenants, which is most of them, still have it open. We find out what in your office actually relies on Direct Send, usually a scanner or a line-of-business application, move those to an authenticated connection, and then close it.
Training that uses examples from your own inbox
Filters catch most phishing. The rest reaches a person, and the best attacks are written to look exactly like the work they do every day. Generic annual training videos do little against that.
- Short sessions, built on real phishing that reached your industry and, with your permission, your own inbox
- Simulated phishing campaigns run through a training platform, or Microsoft’s own tools where your licence includes them
- A written rule that any change to banking details is confirmed by phone, on a number you already had, never one from the email
- A clear way to report a mistake, with no blame, because a click reported in five minutes is far cheaper than one hidden for five days
The banking rule alone stops most invoice fraud, and it costs nothing. We help you write it, and we check that finance staff know it applies even when the request appears to come from the owner. Our pages for law firms and accounting firms cover the payment risks specific to those offices.
Email security work we quote
Endpoint protection, email filtering and multi-factor sign-in are part of our managed IT plan. Projects that go beyond the plan, such as a full DMARC rollout or recovery after a compromise, are quoted at a fixed price. If you think a mailbox has been taken over right now, call our 24/7 emergency line rather than filling in a form.
- Email security review of a Microsoft 365 tenantFixed quote
- SPF, DKIM and DMARC taken to full enforcementFixed quote
- Direct Send closed and scanners moved to authenticated mailFixed quote
- Phishing-resistant sign-in with passkeys and Windows HelloFixed quote
- Mailbox compromise investigation and clean-upFixed quote
- Phishing awareness sessions for staffFixed quote
Questions people ask
Does Microsoft 365 already include email security?
Every business plan includes basic spam and malware filtering. Business Premium adds Defender for Office 365 Plan 1, with Safe Links, Safe Attachments and impersonation protection, plus the sign-in controls that stop stolen sessions. Most tenants have only the basic filtering configured, so even offices that own the better tools are often not using them.
What is business email compromise?
It is when an attacker gets into a real mailbox or imitates one, then uses it to redirect payments, usually by sending an invoice with changed banking details. It often starts with a fake Microsoft sign-in page and can go unnoticed for weeks.
Doesn't multi-factor sign-in stop phishing?
It stops most password-only attacks, but modern phishing kits can pass a text or app code through a fake page and steal the session that results. Phishing-resistant methods such as passkeys and Windows Hello, together with rules that require a company device, stop that technique.
What are SPF, DKIM and DMARC?
Three DNS records that tell other mail servers which senders are allowed to use your domain, prove messages were not altered, and say what to do with mail that fails those checks. Set up fully, they stop others sending email in your company's name.
Will turning on DMARC block our own email?
Not if it is done in stages. We list every service that sends as your domain, run DMARC in monitoring mode while fixing each one, and only then move to quarantine and reject. Legitimate mail keeps flowing throughout.
What is Direct Send and should we turn it off?
Direct Send lets mail reach your mailboxes without signing in, if it claims to come from your own domain. Attackers use it to send phishing that looks internal. Most offices should turn it off after moving any scanner or application that depends on it to an authenticated connection.
What should we do if we think a mailbox has been hacked?
Call our 24/7 emergency line. We reset the account and revoke its sessions, remove any rules the attacker created, check what was read or sent, and help you work out whether clients need to be warned and whether a privacy breach report is required.
Is phishing training worth it for a small office?
Short, relevant training is. A rule that any change to banking details is confirmed by phone on a known number stops most invoice fraud on its own. Brief sessions built on real examples help staff spot what the filters miss.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.