Most cyber security advice for small businesses reads like a checklist written for a company ten times the size. Firewalls, intrusion detection, security operations centres. None of that is where the real risk sits for most SMEs. The real risk sits in the inbox, because that is where almost every serious incident actually begins.
Why email is the entry point, not the target
An attacker rarely breaks into a network directly. It is far easier to send someone an email that looks routine enough to click, and let that one click do the rest. A fake invoice, a message that appears to come from a supplier, a login page that looks exactly like the real one. The email itself is not the damage. It is the door.
This is why email security is not really a separate item on a list. It sits underneath almost every other control, including the five that Cyber Essentials is actually built around.
Phishing does not look like phishing anymore
The old advice, watch for spelling mistakes and strange sender addresses, was written for a much less convincing generation of scams. Modern phishing emails are often well written, correctly branded, and timed around something genuinely plausible, an invoice at month end, a password reset around when your team actually resets passwords, a message that appears to come from a real colleague's real address because that colleague's account has already been compromised somewhere else.
The practical shift this requires is treating unexpected requests to click, log in, or pay as worth a second look by default, not just when something feels obviously wrong.
Passwords alone stopped being enough a long time ago
A strong password protects you against someone guessing it. It does nothing if that password was reused somewhere else and leaked in an unrelated breach, which happens constantly and rarely makes headlines when it is a smaller service. Multi factor authentication is the control that actually closes that gap, since a leaked password on its own is no longer enough to get in.
This is one of the five controls Cyber Essentials checks specifically, and it is usually the single biggest jump in real protection for the smallest amount of disruption to how your team actually works.
What good email hygiene looks like day to day
- Multi factor authentication enabled on every account, not just the ones that felt important at setup
- A proper, hosted business email platform rather than a personal account being used for business, since platforms like Microsoft Office 365 include filtering and protection that personal email was never built to provide
- A habit, not a policy document, of checking anything asking for a payment or a login by a second channel before acting on it
- Old accounts, particularly for former staff, actually disabled rather than left dormant
None of this requires specialist knowledge to follow. It requires someone making sure it is actually in place, which is usually the part that quietly slips once a business is busy.
Getting started
The honest starting point is finding out where you already stand, not assuming. Multi factor authentication that is enabled for some staff but not others is more common than you would expect, and it is exactly the kind of gap that only shows up once someone actually checks.
Evoogic Ltd includes email security as a core part of every Managed IT Services plan for businesses across Milton Keynes, Bedford, Northampton and the surrounding area. Book a free review and we will tell you plainly where your setup actually stands today.
