Email security for small businesses

What small businesses are actually up against

Small businesses are attractive targets because they move money by email, often have no full-time security staff and trust a small circle of suppliers and clients. The attacks that cause the most damage are usually quiet ones:

• Changed bank details: a supplier, landlord or client appears to email new payment details, and the next payment goes to a criminal. See invoice fraud
• Impersonation of the owner or a director: an urgent request to pay, buy gift cards or send payroll data, covered under whaling attack and BEC attack
• Fake sign-in pages: a shared-document or voicemail notification that leads to a copy of the Microsoft or Google sign-in page
• A compromised mailbox: once an attacker has one account, they reply inside real email threads. See email account takeover

None of these needs malware, which is why a traditional spam filter on its own is not enough.

Step 1: configure what you already pay for

Start with the platform you have. This step uses protection you already pay for, so it usually costs time rather than new licences.

On Microsoft 365, apply Microsoft's Standard or Strict preset security policies, turn on impersonation protection for directors and key suppliers, block automatic forwarding to external addresses, switch on user reporting and require multi-factor authentication for every account. Microsoft 365 Business Premium includes Defender for Office 365 Plan 1, which adds Safe Links, Safe Attachments and impersonation protection; on many other plans it is available as an add-on. Our Microsoft 365 phishing protection guide walks through the policies, and Exchange Online Protection explains the baseline every mailbox already has.

On Google Workspace, turn on advanced phishing and malware protection (attachments, links and external images, and spoofing and authentication), warn users about external recipients and enforce 2-Step Verification. Google's Security Sandbox for attachments is supported in Business Standard and Business Plus but not Business Starter. Our Gmail security settings guide lists the settings in order, and the Google Workspace email security hub covers what to add.

Step 2: add an API layer with automatic remediation

For most small businesses, the next layer should be integrated cloud email security rather than a gateway. It connects to Microsoft 365 or Google Workspace by API, needs no MX change, inspects internal mail and can pull a phishing email out of every inbox once it is identified, which matters when nobody has time to search mailboxes by hand.

A sensible shortlist depends on what you already use:

• IRONSCALES: mailbox-level detection of BEC and impersonation with automatic remediation, for Microsoft 365 and Google Workspace; see the IRONSCALES guide
• Check Point Email Security: API protection that can run inline, with Teams, Google Drive and Slack coverage; see Check Point Harmony UK
• Acronis Email Security: managed in the same console as Acronis backup, so a natural fit if you already use Acronis; see Acronis Email Security
• Vade for M365: AI anti-phishing for Microsoft 365 with automatic removal after delivery (Vade also makes a Google Workspace version, confirmed at quote); see Vade for M365
• ThreatDown Email Security: mailbox protection in the same console as ThreatDown endpoint protection; see ThreatDown Email Security
• Sophos Email or Bitdefender: email in the same console as your Sophos or Bitdefender endpoints; see Sophos Email and Bitdefender email security

If you need continuity during a Microsoft or Google outage, or an archive from the same supplier, a secure email gateway such as Proofpoint Essentials may suit better. ICES vs SEG explains the trade-off.

Step 3: SPF, DKIM and DMARC on every domain

Email authentication stops criminals sending mail that appears to come from your exact domain, which protects your customers from fake invoices in your name. Every domain you own needs an SPF record, DKIM signing and a DMARC policy, including domains you do not send from.

It also affects deliverability: Gmail and Outlook.com require authentication from organisations that send in volume, as our guide to the Google bulk sender guidelines explains. If a security scan has flagged "DMARC policy not enabled", that page shows the safe path to fix it.

The NCSC retired Mail Check on 31 March 2026, so if you relied on it you now need your own DMARC reporting. Options we supply include Valimail Core and Pro, IRONSCALES DMARC, Sophos DMARC Manager (included in Sophos Email Plus) and Check Point DMARC Management. Our email authentication hub compares them.

Step 4: encrypt the personal data you send

UK GDPR requires appropriate security for personal data, and email is how most small firms send payslips, client documents, medical letters and contracts. Transport encryption (TLS) protects most mail between servers, but for sensitive content you usually want encryption that the recipient opens in a portal or a protected file.

Microsoft 365 includes Microsoft Purview Message Encryption in several plans, and dedicated services add policy rules and branded portals: Echoworx, IRONSCALES Email Encryption, Proofpoint Essentials encryption and the Sophos Email Portal Encryption add-on. Our guide on how to send secure email compares the methods, and email DLP covers rules that catch misdirected or sensitive mail before it leaves.

Step 5: make reporting easy for staff

Staff will see things a filter misses. Give them a report button in Outlook or Gmail, agree who looks at what they report, and make sure suspicious messages can be removed from every inbox, not just the reporter's. Several API products, including IRONSCALES and Vade for M365, include a report button and can act on what staff report.

Short, regular training helps people spot payment requests and fake sign-in pages. Our sister site covers phishing awareness training and how to report phishing.

Sector notes

The steps above apply to every small organisation, but the emphasis changes by sector:

• Accountants and bookkeepers: you send tax and payroll data and receive payment requests all day, so encryption for outbound documents and BEC detection for inbound requests matter most
• Solicitors and conveyancers: client money and completion dates make you a target for changed-bank-detail fraud; combine impersonation detection, lookalike-domain checks and a firm process for verifying any change of payment details
• Schools and academies: many run Google Workspace for Education or Microsoft 365 Education, with large numbers of accounts; API layers that cover both email and shared drives suit mixed estates
• Charities: donor and beneficiary data needs protecting on a tight budget, so start with configuration and DMARC, then add an API layer sized to the staff who handle money and data
• Healthcare practices: patient information sent by email needs encryption, and practices that complete the NHS Data Security and Protection Toolkit will want their email controls documented

We do not quote sector statistics because they vary by source; we would rather look at the mail you actually receive.

Options by size and platform

For every platform side by side, see email security platforms compared.

How we help small businesses

We work with small organisations that do not have a security team. We can review your Microsoft 365 or Google Workspace settings, fix SPF, DKIM and DMARC, recommend an API layer if you need one and set it up with you, including the report button. We explain what each option does in plain English and help you license only the people who need it.

Pricing depends on the product and the number of users or mailboxes, so ask us for a quote. Contact us to get your email set up properly.