Email Security Fundamentals: The Business Guide

Most businesses have *something* in place — a spam filter, a Microsoft 365 subscription, the default settings their IT provider switched on years ago. The problem is the distance between "something" and a properly configured posture. That distance is exactly where successful attacks land. Email remains the number one delivery route for cyber attacks, and phishing is the most common breach vector reported by UK organisations (NCSC). If you want a practitioner's view of how these controls fit a wider defence, our managed cybersecurity approach treats email as the front door — because attackers do.

This guide gives you the framework to assess where you are and what you still need. It is the four pillars, in the order we deploy them for clients.

What are the four pillars of email security?

The four pillars are authentication, filtering, encryption and user training. Authentication proves your email is genuinely yours and stops criminals spoofing your domain. Filtering blocks malicious inbound content. Encryption protects message contents. Training equips staff to catch what slips through. No single pillar is sufficient on its own — they work as a layered system.

Think of it as defence in depth applied to one channel. Authentication and filtering are the technical perimeter; encryption protects the payload; training is the human backstop. Skip any one and you leave a predictable hole. The sections below cover each pillar, what good looks like, and the mistakes we see most often when auditing UK SME email setups.

Pillar 1: How does email authentication stop spoofing?

Email authentication uses three DNS-published protocols — SPF, DKIM and DMARC — to prove a message genuinely came from your domain. Email was designed without any sender verification, so anyone could claim to send from your address. These three records close that gap and stop your domain being used in phishing campaigns against your own customers.

The protocols build on each other, so deploy them in order. Here is what each one does:

The correct progression is deliberate: deploy DMARC at `p=none` to monitor, use the aggregate reports to find every legitimate sending source, confirm they all pass SPF and DKIM, then move to `p=quarantine` and finally `p=reject`. A policy of `p=reject` gives the strongest protection against your domain being impersonated. If you want the deep dive on the policy layer, our explainer on what DMARC is walks through each tag. The NCSC publishes a free anti-spoofing service and guidance for UK organisations getting these records right (NCSC).

Pillar 2: How does email filtering block malicious content?

Authentication stops fraud *from* your domain, but does nothing about malicious mail arriving *into* it. That is the filtering pillar. A secure email gateway inspects every inbound message against threat intelligence and multiple detection techniques, quarantining or stripping anything dangerous before it reaches a mailbox.

Modern gateways layer several methods, because no single technique catches everything:

• Signature-based detection — matches known malware and malicious URLs against threat databases
• Heuristic analysis — flags suspicious characteristics in new, unknown threats based on patterns resembling known attacks
• Sandboxing — detonates attachments in an isolated environment to watch their behaviour before delivery
• Machine learning — spots anomalous content, headers and metadata that indicate phishing, even with no matching signature

Microsoft 365 includes Exchange Online Protection on all plans and Microsoft Defender for Office 365 on Business Premium and above (Microsoft). For higher-risk environments, AMVIA layers the Barracuda email security suite on top for deeper filtering and attachment defence. Other gateways from vendors such as Mimecast and Proofpoint occupy the same market space. Whatever the tool, filtering pairs naturally with active phishing protection — the gateway blocks the volume, and your wider controls handle what gets through.

Pillar 3: What encryption does business email need?

Filtering protects your inbox; encryption protects the contents of messages you send and receive. There are three levels, and most UK SMEs need the first two: TLS for everyday transit and message-level encryption for sensitive external mail. End-to-end encryption is reserved for defined high-trust relationships.

For most businesses, enabling TLS enforcement and configuring Microsoft 365 Message Encryption for sensitive mail covers the practical requirement. Pushing S/MIME across a whole workforce is rarely worth the operational cost. Encryption choices also sit inside your wider Microsoft 365 security configuration, which is where AMVIA usually tunes these settings for clients.

Pillar 4: Why does user training still matter?

Technical controls cut the volume and impact of threats but never reach zero. The human layer — staff who recognise a suspicious email and know how to report it — catches the small percentage that defeats filtering. Effective training is a continuous programme, not a once-a-year slideshow, and the reporting culture matters as much as the content.

A programme that actually changes behaviour includes:

• Regular awareness sessions covering current phishing and business email compromise tactics
• Simulated phishing with immediate, contextual feedback when someone clicks
• A clear, fast reporting route so staff can escalate suspicious mail
• A culture where reporting a suspected phish is normal and praised, never embarrassing

The NCSC's Cyber Essentials scheme — which AMVIA supports clients to achieve, and holds the Cyber Essentials Plus certification ourselves — sets the foundational technical controls (secure configuration, access control, malware protection) that complement this four-pillar approach (Cyber Essentials, gov.uk). Training plus certification is the combination that holds up under a real attack.

What does AMVIA actually recommend?

If we audit a typical UK SME, the priority order is consistent: turn on MFA and fix SPF first, get DMARC into monitoring, layer Defender for Office 365 (and Barracuda where the risk justifies it), enable message encryption for sensitive mail, then run continuous phishing training. Most of the wins are configuration, not new spend.

The single most common finding is an SPF record that has not kept up with the business — new sending services bolted on over the years, never added to the record, so legitimate mail is at risk while the domain is still spoofable. The second is a DMARC policy stuck at `p=none` indefinitely. Both are fixable in an afternoon. For a managed approach across endpoints and mail, Microsoft Defender for Business gives smaller teams enterprise-grade protection without a dedicated security hire. One provider, security-first, Microsoft-certified.