5 things worth knowing about business email security

Business email security rarely fails because of a broken encryption algorithm. It is someone signing in as a colleague, or a supplier's invoice arriving with different bank details, or a forwarding rule quietly copying the finance inbox to an address nobody recognizes.

Those three failures have almost nothing to do with each other, and the controls that stop one do very little about the others. So this page is organized by attack rather than by feature: what actually happens, and which specific setting or habit blocks it.

Five things worth knowing

Three different problems in one inbox

Account takeover means someone is using a real mailbox as its owner. Their mail is genuinely from you, passes every authentication check, and can read everything the account can read. Passwords, phishing pages that capture a second factor in real time, and reused credentials from an unrelated breach are the usual routes.

Impersonation means nobody broke into anything. A message arrives that looks like it came from a colleague or a supplier, using a similar display name, a similar domain, or a real but unrelated address. For mail claiming to come from your domain, configure SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These standards help receiving systems authenticate mail from your domain. Authentication on your domain does nothing here, because the message is not claiming to be your domain.

Interception and misdirection means the message went somewhere it should not have: a mistyped recipient, an auto-complete entry for the wrong person, an oversized reply-all, or a forwarding rule set up by someone who has already been inside.

Write those three on a page before you evaluate anything. Most security features address exactly one of them, and vendors rarely say which.

Controls, matched to what they actually block

Rolling the second factor out is its own small project. Options include FIDO2/WebAuthn security keys or passkeys, authenticator apps, and SMS codes; they differ in phishing resistance. The argument you will have with colleagues about which method to require is covered well in the guidance on multi factor authentication for corporate services, which is blunt about what each method does and does not resist.

The row that surprises people is the last one on the second factor. A second factor is worth having and is not a wall. Plan for the case where it is bypassed, which is what the rest of this page is about.

The payment diversion problem

The single most expensive mail incident for a small business rarely involves your systems at all. A supplier's mailbox is compromised, their genuine invoice thread is read, and a message arrives in the middle of a real conversation, in the right tone, at the right moment, saying the bank details have changed.

No mail filter reliably catches this, because the message is real mail from a real account discussing a real invoice. What defeats it is a payment process, and the plain summary of that reasoning for small businesses is in the FTC's Start with Security, which puts the control on the process rather than on the software:

Write this down and give it to the people who pay invoices. It is worth more than any product decision on this page.

What an intruder leaves behind

A password reset ends the session. It does not undo the setup work. After any suspected compromise, and periodically anyway, check for:

The controls people wish they had set first

Some settings are cheap on day one and painful to retrofit once people have habits. Set them while the estate is small, ideally as part of the initial setup sequence:

That last one is the control most often left undefined, and it is the one an attacker will use. Every technical measure on this list is only as strong as the process for bypassing it in an emergency.

Common questions

Is encryption the thing to focus on?

Rarely. Transport encryption between mail systems is now normal, and storage encryption protects against a threat most small organizations do not face. End to end encryption is worth pursuing for a specific category of message, not as a general posture, and it complicates search, filtering, and record keeping in ways worth understanding before committing.

Does a stricter spam filter solve impersonation?

It helps with the crude attempts and not the good ones. A message from a compromised supplier is ordinary mail by every measurable property. Filters reduce volume; process decides outcomes.

How much of this depends on the provider?

Less than you would expect. Enforced second factors, administrator separation, forwarding restrictions, and audit logs are widely available. What varies is which tier they sit in and how much work they are to operate, which is a reasonable thing to test while evaluating candidates and a poor thing to discover afterward. For example, when evaluating Microsoft 365 or Google Workspace, verify these controls and audit-log retention for the specific plan rather than assuming they are included.

Who should be doing this in a small company?

One named person, with a calendar reminder, and a deputy. Most of the checks above take under an hour a quarter. The failure mode is not difficulty, it is that the work belongs to nobody, which is the same reason the administration layer drifts.