Email security and phishing defense

Email is where most attacks on small businesses start: a link to a fake login page, an invoice with a malicious attachment, or a plain message from someone pretending to be the owner or a supplier. Email security tools sit between the internet and your inboxes, or connect to your mail service directly, and try to catch those messages before a person acts on them.

There are two main designs. A secure email gateway sits in front of your mail service. You point your domain's MX record at the gateway, it scans every incoming message for spam, malware and phishing, and passes the clean ones on. Gateways also handle outgoing filtering, encryption and archiving. The newer API-based tools connect to Microsoft 365 or Google Workspace through the provider's own interfaces, read mail after it arrives, and pull bad messages out of inboxes. They need no change to mail routing and can also see internal mail between staff accounts.

The AI in this category is aimed mostly at messages with no malware at all. Business email compromise, where an attacker poses as an executive, a lawyer or a vendor and asks for a payment or gift cards, often carries no link or file for a scanner to catch. Tools here build a picture of normal communication: who usually writes to whom, which vendors send invoices, how a person phrases things and where they log in from. A message that breaks that pattern gets flagged or removed. Language models are also used to read the intent of a message, such as urgency around a payment.

Start by checking what your mail service already does. Microsoft 365 includes Exchange Online Protection, and Defender for Office 365 adds link rewriting, attachment sandboxing and impersonation protection. Google Workspace has its own filtering and phishing warnings. Many small companies gain a lot by turning on and tuning these settings, and set up SPF, DKIM and DMARC records so others can't easily send mail as their domain.