Cyber Security
Email Security
Stop phishing, spoofing and malware before it reaches your team’s inboxes.
Prefer to talk? Call 020 4634 2518 · Rated 5.0 on Google · UK-wide coverage
Got it, thank you. Your callback request is with the team. We’ll respond the same working day. Need it sorted sooner? Call 020 4634 2518
- Customer satisfaction
- 100%
- Years of combined experience
- 35+
- Average first response
- 9 min
Overview
Email is the front door for attackers
Email is the most common way attackers get in, phishing, spoofing, business email compromise and malware all arrive in the inbox.
WhizzIT layers advanced email security over Microsoft 365 and Google Workspace, filtering threats, protecting against impersonation and keeping your inboxes safe.
Email protection is layered over your existing Microsoft 365 or Google Workspace tenancy rather than replacing it, so filtering, impersonation protection and quarantine are managed alongside the rest of your cloud. It is priced per user at a fixed monthly cost rather than bundled into rigid packages, so it scales with your team. Everything runs through the same UK service desk that handles your day-to-day tickets, so there is no separate team to chase. Across 2025 our average first response time was 9 minutes and our average resolution time was 6 hours, measured across every ticket we handled.
Cyber SecurityEmail Security
What’s included
- Advanced anti-phishing and anti-spam
- Malware and attachment scanning
- Impersonation and spoofing protection
- Link protection and safe attachments
- Domain authentication (SPF, DKIM, DMARC)
- Continuous monitoring
How attacks work now
Phishing does not look like phishing any more
The training example everyone remembers is a badly spelled email from a stranger with an obvious link. Almost nothing looks like that now.
Layers we put in place
- Advanced anti-phishing and anti-spam filtering
- Attachment scanning and link rewriting
- Impersonation protection for named people
- SPF, DKIM and DMARC configured and enforced
- Mailbox rule and forwarding alerts
- Awareness training so people know what to check
01 / 05
A genuine SharePoint or Dropbox share notification, sent from the real platform, pointing at a document that happens to be malicious. Because the notification really did come from the platform, it passes every check a filter can reasonably make.
02 / 05
A QR code in an attachment, because it moves the attack onto a phone where there is no filtering and no visible address bar. The message itself carries no link for anything to inspect.
03 / 05
A reply inserted into an email thread that has been running for weeks, from a supplier whose mailbox was compromised last month, so it has real history above it. Nothing about the conversation looks new or unusual.
04 / 05
The one that catches the most people. An attacker with a stolen password sits between you and Microsoft using a proxy page that looks exactly right. You type the code, and they capture the session token rather than the password. Multi-factor authentication still matters enormously, but on its own it is not the finish line people assume.
05 / 05
Filtering deals with volume. What it will not do is make a convincing message from a real supplier account look wrong, which is why authentication, monitoring and a team that knows to check unusual requests all sit alongside it.
Business email compromise
The expensive one involves no malware at all
The most costly email attacks we deal with do not carry a payload. Someone gets into a mailbox with a working password, sits quietly and reads. They learn how your invoices are worded, who signs things off, when your finance person is on holiday. Then they send one message asking for bank details to be updated, from a real internal account, in the house style.
-
Why nothing gets flagged
There is nothing for antivirus to find, because nothing was installed. The usual tell is a mailbox rule the attacker added to hide their tracks, quietly moving replies into an obscure folder so the real owner never sees the conversation happening in their name. That is why alerting on new forwarding and filing rules matters more than it sounds.
-
The control that actually stops it
The other half of the answer is not technical. Any request to change bank details gets verified on a phone number you already had, never one supplied in the email itself. It is a dull control that defeats a very profitable attack.
Domain authentication
SPF, DKIM and DMARC, without the jargon
Three records that decide whether anyone can send email pretending to be you.
-
SPF
Lists the servers allowed to send mail for your domain. If a message arrives from somewhere not on the list, the receiver has grounds to be suspicious. It breaks quietly when you add a new sending tool, such as a mailing platform or a booking system, and nobody updates the record.
-
DKIM
Signs your outgoing mail cryptographically so the receiver can confirm it genuinely came from you and was not altered on the way. It answers the question SPF cannot, which is whether the message itself is authentic rather than just the route it took.
-
DMARC
Ties the two together and tells receivers what to do when a message fails. This is where most businesses stop too early. A DMARC record set to none is monitoring only, and does nothing to stop spoofing. Moving carefully to quarantine and then reject is what actually protects your domain, and it is exactly what we manage for you.
Certified & accredited
Credentials you can check
-
Cyber Essentials certified
Independently assessed against the UK government-backed scheme, so our security fundamentals are verified rather than simply claimed. We help clients certify too. How Cyber Essentials helps you -
Microsoft Cloud Solution Provider
A direct partnership with Microsoft. We license, deploy and support Microsoft 365 and Azure for you, with escalation straight to Microsoft when it is needed. Our Microsoft cloud services
Cyber Essentials is a UK government scheme run by the National Cyber Security Centre, delivered by IASME. You can verify what the certification covers at source.
Ready when you are
Tell us what is slowing your team down
Describe the problem in a sentence. We’ll respond the same working day, with no obligation.
Have been using this company for a few months and I couldn’t be happier. Very professional and reliable.
How we help
What we deliver
-
Filter
Threats are caught before they reach the inbox.
-
Authenticate
We configure SPF, DKIM and DMARC to stop spoofing of your domain.
-
Monitor
We monitor continuously and tune protection as threats evolve.
Good to know
Frequently asked questions
Not covered here? Ask us directly — same working day response.
020 4634 2518What does email security protect against?
Phishing, spam, malware, spoofing, impersonation and business email compromise across Microsoft 365 and Google Workspace. In practice the hardest of those to stop is a genuine message from a supplier whose account has been compromised, which is why filtering alone is never the whole answer.
Does Microsoft 365 already include this?
It includes real capability, and a lot of what we do is configure that properly rather than sell you something on top. Defaults are permissive, impersonation protection needs your actual names and domains added, and SPF, DKIM and DMARC are your job rather than Microsoft’s. Where the built-in tooling genuinely falls short we add a layer, and we will tell you which is which.
What are SPF, DKIM and DMARC?
Three DNS records that stop attackers sending email as your domain. SPF lists who may send, DKIM signs your mail so it can be verified, and DMARC tells receivers what to do with anything that fails. Most businesses have DMARC set to monitoring only, which looks reassuring in an audit and prevents nothing. We manage the move to enforcement.
We have multi-factor authentication. Is that enough?
It is one of the most valuable things you can switch on, and it is still not sufficient by itself. Attackers now use proxy pages that capture the session after you approve the prompt, so the login succeeds without them ever knowing your password. Phishing-resistant methods, conditional access and monitoring for odd sign-ins are what close that gap.
Someone has already been compromised. Can you help?
Yes, and the order matters. Sessions get revoked and the password reset, because changing the password alone leaves an active session running. Then we look for mailbox rules the attacker added, check what was accessed and whether anything was sent in their name, and work out how they got in so it does not simply happen again.
Do you train our staff as well?
Yes. Filtering plus authentication handles most of the volume, but the attacks that get through are specifically designed to persuade a person. Security awareness training and phishing simulation are a separate service and they pair naturally with this one.
Technology partners
Brands we partner with
We hold partner status with the vendors behind the tools we deploy, so your licensing, support and escalation come direct from the source rather than through a reseller chain.
