Phishing and Business Email Compromise: A Defender’s Guide
Why phishing still works, how business email compromise turns into payment fraud, and the technical and human controls that reduce the risk.
Explore the Phishing Guide
Eleven chapters, each one readable on its own. Most include a tool you can use as you read.
Why phishing still works
Phishing remains the most common way into an organisation because it targets people, not systems.
The anatomy of a phishing email
A phishing email combines a believable sender, a reason to act now and a link or attachment.
Business email compromise and invoice fraud
In BEC, attackers impersonate a manager or supplier to redirect payments.
Credential phishing and MFA fatigue attacks
Fake login pages steal passwords, and repeated push prompts wear users down until they approve.
Email authentication: SPF, DKIM and DMARC
These records stop attackers from sending email that appears to come from your own domain.
Filtering, sandboxing and link protection
Modern email security scans links and attachments at the time of the click, not only on delivery.
Building a reporting culture
Fast reporting turns one user into an early warning for everyone.
Running phishing simulations that teach
Simulations work when they are realistic, regular and followed by short learning.
Payment verification processes for finance teams
A simple call-back rule stops most invoice fraud.
Responding to a reported phish
A quick response limits the damage when someone has clicked or replied.
Measuring awareness: metrics that matter
Good metrics show whether behaviour is changing.
Check Your Phishing Defences
Review your email security and awareness programme and get the checklist in your inbox.
- Email security: Publish SPF, DKIM and an enforced DMARC policy. Chapters 5 to 6
- People: Make reporting a phish quick and safe. Chapters 7 to 8
- Finance: Verify every change of bank details by phone. Chapter 9
Get Your Free Phishing Gap Checklist
Delivered to your inbox instantly.
No spam. EU data residency. Unsubscribe any time.
Get a 30-Minute Security Briefing.
No Pitch Deck.
Talk to a Sweden-based analyst. We'll review your posture, map your gaps and give you a clear picture of where you stand, in plain language.
Book a Free Briefing