Defend
Email security
Most attacks on a firm start with one convincing email. Email security filters spam, phishing and malware out before a mail reaches anyone, and keeps the mail you are bound to keep.
One convincing email is where most of it starts.
Invoices, client documents and shared files make perfect bait, and a mail that looks like it comes from a client gets opened. Email security is the layer before anyone sees it: every mail your firm receives is checked for its sender, forged addresses, dangerous attachments and links before it lands in an inbox, and what fails the check is held back. Your own domain carries the records that let other mail systems tell a mail from your firm from one that only claims to be. And because mail is often the record of a matter, it is archived for the years you have to keep it. The filter stops most of it. People and a fixed sequence handle the rest.
What we set up
Filtered before it lands, checked when it doesn’t.
The filter runs in front of your Microsoft 365 mailboxes. Its rules are tuned to how your firm writes and receives mail, so real mail arrives and the fakes don’t.
-
Spam, phishing and malware held back
Every incoming mail is checked before delivery: the sender, the links, the attachments. What fails is quarantined, not delivered. A held mail that was real is released on request, and the rule is adjusted.
-
Your own address, hard to forge
Your domain carries the records that let other mail systems tell a mail from your firm from one that only claims to be (SPF, DKIM and DMARC). Fewer fakes in your clients’ inboxes, and fewer of your mails in their spam folder.
-
Forwarding rules watched
An attacker who gets into a mailbox usually sets a rule first, one that forwards or hides mail. New forwarding rules and unusual changes are flagged, so a quiet takeover doesn’t stay quiet.
-
Long-term archiving
Mail is archived for the years your firm is bound to keep it, so a mail deleted from the inbox is still in the archive when a matter comes back years later. The retention period is agreed with you and written down.
-
When one gets through
Phishing gets through at well-run firms too. Then the sequence is always the same: you tell us, we lock the account, check what was sent and to whom, clean up, tell you first, and write it down.
-
The sign-in behind the inbox
A stolen password alone opens nothing: a second factor and conditional access stand behind every mailbox, so a phishing mail that fools someone still doesn’t get the attacker in.
On record
In your evidence file.
- The filter rules in force, and when they were last reviewed
- Your domain’s mail authentication records, as they are set
- The archive: what is kept, and for how long
- Every incident: what happened, what we did, what we changed
Ready for your insurer’s question about phishing protection, on the day it comes.
What usually goes wrong without it.
-
The filter nobody tunes
Set up once, never adjusted: the real mail from a new client lands in quarantine, so someone turns the filter down, and the next fake lands in the inbox.
-
A domain anyone can send as
Without the authentication records, a mail that claims to come from your firm looks exactly like one that does. Your clients can’t tell the fake invoice from yours.
-
The forwarding rule nobody saw
A taken-over mailbox quietly forwards every mail about a payment to an outside address for weeks. It comes to light when a client asks why the bank details changed.
Also under Defend
- Multi-factor sign-in A second factor for every account, so a stolen password on its own opens nothing.
- Conditional access Who is signing in, from where and on which device, checked every time.
- Device protection Managed protection and threat detection on every laptop, workstation and server, to a documented baseline.
- Patching and vulnerability management Updates rolled out from one place, and the gaps that remain found and closed.
- Admin access Admin rights for few, by name; passwords in a vault; every use logged. Our own keys first.
- Backups and restore tests Backed up, restored on purpose before you need it, dated, and kept for the years you’re bound.
- Security monitoring Devices, sign-ins and systems watched centrally; what the monitoring found, reviewed by our engineers, and what we changed.
- Access reviews Who can open what, reviewed with you, so access that made sense last year doesn’t quietly stay.
- Incident response When someone clicks, or a server shows a ransom note: the same sequence every time, ending in the record.
- The evidence file What protects your firm, written down as it is, ready on the day an insurer, a client or an auditor asks.
- Insurer and client questionnaires Your insurer’s and your clients’ security questionnaires, answered with what’s true today, the gaps closed before renewal.
- Changing provider The old provider’s software and access removed, with a written check that nobody keeps a way in.
Questions we get
Will real mail get lost in the filter?
Some real mail will be held, above all in the first weeks: a new client, an unusual attachment. Held mail stays in quarantine, visible to you and to us, and is released on request. Each release teaches the rules.
How do my people recognise a mail that gets through anyway?
By the signs that don’t change: a sender domain that sounds official, for an office that doesn’t exist; a “Re:” on a mail nobody answered; pressure to act by tomorrow; a signature without company details. The rule for everyone: don’t reply, don’t click, and check the sender through its official website, never through the contact details in the mail.
What about mail we have to keep for years?
It is archived for the period your firm is bound to. Deleting a mail from the inbox doesn’t delete it from the archive, and a matter from years ago can be found again. The retention period is agreed with you and written down.
Can you show an insurer that it’s in place?
Yes. The filter rules, your domain’s authentication records and the archive settings are in your evidence file, with the date they were last reviewed.
Start
What happens in your firm when someone clicks?
In a first call we go through how mail reaches your people today, what stops a fake before it lands, and what would happen next if one got through.
- No first level
- No surprises
- Pilot before you buy