Phishing Protection for UK Businesses: Controls That Actually Work

Nathan Hill-Haimes, Technical Director 9 min read · Mar 2026

Phishing is the most common initial attack vector in UK cyber incidents, behind most ransomware deployments, account takeovers and data breaches. This guide covers the technical controls that stop it and the training that reduces susceptibility — the same approach AMVIA uses to deliver managed cybersecurity for UK SMEs. If you only fix one thing this quarter, fix your email authentication and MFA.

---

How big is the phishing threat to UK businesses in 2025?

Phishing is the single most common attack type reported by UK organisations. The government's Cyber Security Breaches Survey 2025 found that 85% of businesses and 86% of charities that identified a breach pointed to phishing as the cause (gov.uk Cyber Security Breaches Survey). It is the threat most likely to actually land.

Modern phishing looks nothing like the clumsy emails of the early 2000s. Campaigns are personalised, visually convincing, and increasingly drafted with AI assistance. The 2024 survey put phishing at 84% of affected organisations (DSIT, 2024 UK data) — and the 2025 figures show the problem getting worse, not better (gov.uk Cyber Security Breaches Survey).

The consequences scale fast. A successful phish can lead to business email compromise, data exfiltration, or full ransomware deployment, with an average UK data breach cost of £3.58 million in 2024 inclusive of recovery, notification and business interruption. For an SME, one significant incident can be existential. That is why managed phishing protection belongs at the top of the security backlog, not the bottom.

---

How do SPF, DKIM and DMARC stop email phishing?

Email authentication stops attackers sending mail that impersonates your domain. SPF, DKIM and DMARC work together: SPF lists who can send for you, DKIM cryptographically signs your mail, and DMARC tells receiving servers what to do when a message fails. They are the foundation every other anti-phishing control sits on.

A DMARC policy of `p=reject` instructs receiving mail servers to reject any message that fails SPF and DKIM, which effectively shuts down direct domain spoofing. Many UK businesses publish SPF but stop short of DMARC enforcement, leaving the domain open to impersonation of their own staff, clients and suppliers.

The NCSC's free Mail Check service assesses your domain's DMARC, SPF and DKIM configuration and tracks it over time (ncsc.gov.uk). It is the fastest way to see where you stand before you spend on tooling. AMVIA configures and monitors this as part of its email security services.

---

What does anti-phishing email filtering add beyond authentication?

Authentication blocks domain spoofing, but it does not catch phishing sent from a legitimate-but-malicious domain or a compromised third party. Inbound filtering adds the layers that authentication cannot: link inspection, attachment sandboxing, AI impersonation detection and lookalike-domain alerts.

• Link scanning: URLs are checked against reputation databases and, in stronger tools, detonated in a sandbox. Microsoft Defender Safe Links rewrites URLs and re-checks them at click-time, protecting users even when a phishing URL was unknown at delivery.
• Attachment sandboxing: Attachments open in an isolated environment so malicious behaviour is caught before delivery. Defender Safe Attachments fills this role.
• AI impersonation detection: Machine-learning models analyse sender behaviour, metadata and content to spot impersonation — even when the sender passes SPF, DKIM and DMARC.
• Lookalike-domain detection: Filters flag mail from domains visually similar to trusted partners (amv1a.co.uk versus amvia.co.uk) that attackers register to impersonate correspondents.

AMVIA's stack for this is Microsoft Defender plus the Barracuda email and network suite — no bolt-on agents, one set of policies, one team accountable for tuning them.

---

Which Microsoft 365 anti-phishing controls should you turn on?

If you run Microsoft 365, Defender for Office 365 Plan 1 — included in Business Premium — gives you the core anti-phishing controls. The catch: the defaults are not the most protective settings. They must be configured, hardened and monitored to actually block modern lures.

Defender for Office 365 provides:

• Safe Links — time-of-click URL checking
• Safe Attachments — sandboxed attachment detonation
• Anti-impersonation policies — protection against spoofed display names
• Anti-spoofing — blocks mail that fails authentication
• Attack simulation training — built-in phishing simulation for staff

Microsoft documents these controls in detail for administrators (learn.microsoft.com — Defender for Office 365). AMVIA includes Microsoft 365 security hardening in every managed package, deploying and watching these policies alongside Microsoft Defender for Business so the configuration does not quietly drift back to defaults.

---

Does security awareness training actually reduce phishing risk?

Yes — but only when it is delivered well. Technical controls cut phishing exposure sharply, yet they cannot eliminate targeted attacks. Training closes that last gap, provided it is frequent, current and blame-free. A once-a-year compliance video does almost nothing; short, regular practice changes behaviour.

What works in practice:

• Short and regular beats annual: Monthly five-minute microlearning embeds awareness far better than a 45-minute yearly video staff click through for the completion badge.
• Simulate without blame: Send realistic phishing simulations and track click rates for objective data. People who click get immediate, constructive coaching — never punishment.
• Train on today's threats: Reflect current techniques — AI-personalised lures, QR-code phishing (quishing) and voice phishing (vishing) — not 2010-era spelling-mistake indicators.
• Build a reporting culture: Staff who fear they clicked something must feel safe reporting it instantly. Early reporting enables rapid containment; punitive cultures suppress it.

The NCSC's phishing guidance reinforces this layered, no-blame approach for organisations (ncsc.gov.uk — phishing).

---

Does MFA protect against every phishing attack?

No — and the difference matters. Standard MFA (TOTP codes, push approvals) defeats credential-only phishing, but adversary-in-the-middle (AiTM) attacks can capture live session tokens and walk straight past it. Phishing-resistant MFA is domain-bound and immune to that trick.

For high-value accounts — executives, finance, IT administrators — prioritise phishing-resistant MFA. For everyone else, enforced MFA is still the single highest-impact control you can deploy. AMVIA rolls this out through multi-factor authentication setup across Microsoft 365 tenants.

---

What should you do when a phishing attack succeeds?

When someone clicks, enters credentials or opens a malicious attachment, your response speed decides the damage. Move in a fixed order: contain the account first, then investigate what the attacker did, then assess data exposure. Pre-agreeing this runbook turns a panic into a procedure.

1. Reset the compromised account password and revoke all active sessions immediately. 2. Enforce MFA if it was not already active — and find out why it was not. 3. Review Microsoft 365 audit logs or your SIEM for actions taken under the account. 4. Check for malicious inbox rules or email forwarding the attacker created. 5. Warn other staff if the account sent further phishing internally or to contacts. 6. Assess whether personal data was accessed — a UK GDPR breach assessment may be required (ico.org.uk).

A practised playbook and 24/7 monitoring are the difference between a contained incident and a breach notification. That is exactly what AMVIA's incident response capability is built for.

---