Email is still the way attackers get in. Not because filtering doesn’t exist, not because business owners don’t care, but because email security isn’t a single product you buy — it’s a layered system, and most small businesses have at least one layer that’s either missing or misconfigured. The result is a setup that feels protected and isn’t.
The typical small business has spam filtering through Microsoft 365 or Google Workspace, antivirus on the endpoints, and a general sense that employees know not to click on suspicious links. That covers some of the threat. It doesn’t cover the part where someone receives an email that looks exactly like it came from the firm’s managing partner, asking accounting to wire a payment to a new account. According to the FBI’s Internet Crime Complaint Center, business email compromise resulted in adjusted losses of over $2.9 billion in 2023 — and the median target is not a Fortune 500 company.
The framework that explains why partial setups fail is straightforward. Email security has three layers — authentication, filtering, and training — and each one addresses a different class of threat. Attackers exploit whichever layer is missing. A business with strong filtering and no authentication gets impersonated. A business with authentication and filtering but no training gets a wire transfer fraud through a perfectly legitimate-looking message. The layers aren’t redundant. They cover different ground.
Authentication: proving the email is actually from who it says it’s from
The fundamental problem with email is that the protocol was designed in an era when nobody anticipated needing to verify the sender. Anyone can send a message claiming to be from your domain. Nothing in the basic email standard stops it. Authentication is the set of three records that retrofit this missing verification onto modern email — SPF, DKIM, and DMARC — and they’re configured in your domain’s DNS settings.
SPF (Sender Policy Framework) is a published list, sitting in your domain’s DNS records, of which mail servers are allowed to send email on your behalf. When a receiving server gets a message claiming to be from yourdomain.com, it checks that list. If the message came from a server that’s on the list, SPF passes. If not, it fails. The mechanism is essentially a public roster of authorized senders.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each outgoing message. The receiving server uses a public key — also published in your DNS — to verify the signature. If the signature checks out, the message provably came from a server holding your private key, and the content wasn’t altered in transit. SPF answers “is this server allowed to send?” DKIM answers “is this message intact and signed by the right party?”
The gap both leave open is what happens when authentication fails. SPF and DKIM can tell a receiving server that a message is suspicious. Neither of them tells the receiving server what to do about it. That’s DMARC.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the policy layer. It says: if a message claiming to be from my domain fails SPF and DKIM, here’s what I want you to do with it — let it through, send it to spam, or reject it outright. DMARC also generates reports back to the domain owner showing who’s trying to send mail as your domain. That visibility is how you discover that someone in Eastern Europe has been spoofing your invoices for six months. For a deeper look at how these three records work together, SPF, DKIM, and DMARC explained for small business owners walks through each one in plain language.
The reason this matters for a business that has never heard of any of it: without DMARC set to a real enforcement policy, an attacker can send an email that appears to come from your CEO’s address, and the receiving mail server has no instruction to reject it. Some providers will quietly accept the message. Some will flag it. The behavior is inconsistent because you haven’t told them what to do. Publishing a DMARC policy of “reject” or “quarantine” — once SPF and DKIM are in place — closes the door on most domain impersonation.
Most small businesses we encounter have SPF configured, often because their email provider set it up automatically. Many have DKIM. Far fewer have DMARC published at all, and of those that do, most are set to “none” — which generates reports but doesn’t actually enforce anything. That’s the most common authentication gap, and it’s the one that lets impersonation through.
Filtering: reducing what reaches the inbox
Filtering is the layer most business owners are familiar with, because it’s the layer with visible output. Spam goes to the junk folder. Obvious phishing gets blocked. Attachments with known-bad signatures get stripped. The filter is doing its job, and most days that job is enormous — the volume of malicious mail aimed at a typical small business inbox is far higher than what actually arrives.
A modern filter runs incoming messages through several checks. It examines the sending IP’s reputation, scans attachments for known malware signatures and suspicious behavior (often by detonating them in a sandbox), inspects URLs by following them and rendering the landing page, and uses machine learning models trained on billions of messages to flag patterns associated with phishing. Good filtering catches the overwhelming majority of generic threats. Microsoft Defender for Office 365, Proofpoint, and Mimecast all do this well when configured properly.
What filtering doesn’t catch is the message that has no traditional threat signature. A plain-text email from what appears to be a vendor asking to update banking information for the next invoice. A message from “the CEO” to the bookkeeper asking for a quick favor before a meeting. A reply that looks like part of an existing email thread, because the attacker compromised one mailbox in the conversation and is now hijacking it from the inside. These messages contain no malware, no suspicious links, no spoofed-looking domains. The filter has nothing to flag.
This is the category called business email compromise, and it’s where the largest financial losses happen. The 2024 Verizon Data Breach Investigations Report found that pretexting — the social engineering pattern behind most BEC — has doubled in prevalence over recent years and now accounts for the majority of social engineering incidents. These attacks succeed because they exploit human judgment, not technical vulnerabilities. No filter, regardless of how sophisticated, can determine whether a payment request is legitimate. That determination requires a person who knows what to look for.
Filtering also struggles with spear phishing — targeted messages crafted for a specific recipient using information gathered from LinkedIn, the company website, or a previously compromised account. The attacker knows the recipient’s name, their role, who their boss is, and what projects they’re working on. The message is plausible. It might contain a link to a credential harvesting page hosted on a freshly registered domain the filter has never seen. By the time the URL is added to threat intelligence feeds, the campaign is over. Learning to spot these attempts before clicking is a skill — our guide to phishing email examples every small business employee should recognize covers the most common patterns in detail.
Good filtering is necessary. It’s the layer that reduces the noise to a level where humans can pay attention to what’s left. But anyone claiming filtering alone is sufficient hasn’t looked at what’s getting through.
Training: the layer that catches what technology misses
Security awareness training has a bad reputation, and most of the time it’s earned. The standard implementation — a 30-minute video during onboarding, maybe an annual refresher, a slide deck someone clicks through while answering emails — produces almost no measurable change in behavior. People nod, sign the acknowledgment, and forget within a week. Then the phishing email arrives three months later, and the click rate is the same as if no training had happened.
Effective training is structured differently. It’s continuous, it includes simulated phishing campaigns that put the actual decision in front of the employee, and it reinforces specific behaviors rather than abstract awareness. The mechanism: every few weeks, employees receive a simulated phishing email crafted to resemble real attacks. Some click. Those who click are immediately taken to a short training page explaining what they missed — the spoofed display name, the urgency language, the request to act outside normal procedure. The next simulation arrives a few weeks later, calibrated to be slightly different. Click rates drop over time. The behavior measurably changes.
The reason this works and one-time training doesn’t is that recognizing a phishing attempt is a pattern-recognition skill, and pattern recognition requires repeated exposure. An employee who has actually paused over a suspicious message and worked out why it’s suspicious — five or ten times across a year — develops instincts that survive a stressful Friday afternoon. An employee who watched a video once does not.
The behaviors that matter are specific and teachable: verify out-of-band before acting on any payment instruction or banking change, regardless of who appears to be asking; hover over links before clicking and read the actual URL; treat urgency and secrecy as warning signs in any financial request; report suspicious messages through a documented channel rather than deleting them, so the security team can warn others. None of these require technical knowledge. All of them require the habit.
The other thing training accomplishes is creating a culture where employees feel safe reporting mistakes. The bookkeeper who clicked a link and entered credentials, who tells someone within five minutes, allows the password to be changed before the attacker uses it. The bookkeeper who’s afraid of being blamed, who says nothing for two days, gives the attacker time to set up forwarding rules and start sending invoices. Training, done well, is as much about reporting behavior as it is about prevention. If an employee does click a suspicious link, knowing what to do immediately after clicking a phishing link can limit the damage significantly.
How the three layers interlock
The argument for treating these as a system rather than three independent tools is mechanical. Each layer handles a class of threat the others can’t.
Authentication reduces impersonation risk. When DMARC is published and enforced, an attacker can’t reliably send mail that appears to come from your domain to anyone whose mail server respects DMARC — which is most of them. The class of attack where a forged email from the CEO lands directly in the bookkeeper’s inbox becomes much harder to execute. It doesn’t eliminate impersonation entirely — attackers can still register lookalike domains — but it closes the most common variant.
Filtering reduces the volume of threats reaching users. The vast majority of malicious mail never makes it past the filter, which means employees aren’t being asked to make a hundred security judgments a day. Their attention is preserved for the messages that actually require it.
Training handles what gets through. The messages that filtering can’t flag because they contain no technical indicators — the targeted BEC attempts, the vendor account changes, the conversation hijacks — depend on a human catching them. A trained human catches a meaningful percentage of these. An untrained one does not.
Remove any one layer and a specific exposure opens up. Without authentication, even trained employees with good filtering will eventually encounter a perfectly forged message from a trusted internal address — and even the suspicious ones who would verify don’t always get the chance, because the message arrives on a busy day with a plausible request. Without filtering, employees are buried in malicious mail and their attention degrades; the one targeted attack in a sea of obvious scams gets through because nobody’s paying close attention anymore. Without training, the messages that bypass the technical layers — and there will be some — succeed at whatever rate the attacker’s craft supports, which historically is high enough to fund a $2.9 billion criminal industry.
A business with all three layers in place isn’t immune. No business is. But the gap an attacker has to find is much narrower, and the cost of finding it is higher than most attackers are willing to pay for a small target. They move on.
How to recognize a gap in your own setup
Without a technical audit, here’s what a business owner can reasonably assess about their own email security posture.
On authentication: ask whoever manages your IT whether DMARC is published for your domain and what policy it’s set to. The answers that indicate a gap are “what’s DMARC,” “we have SPF, that should be enough,” or “it’s set to none/monitoring.” The answer that indicates a real policy is “quarantine” or “reject,” with someone reviewing the reports that come back.
On filtering: the question isn’t whether you have a filter — you do, because every modern email platform includes one. The question is whether anyone has reviewed the configuration recently, whether advanced threat protection features (sandboxing of attachments, link rewriting, impersonation detection) are turned on, and whether quarantined messages are being reviewed by someone or just piling up unseen. The default settings on most platforms are conservative; the protection available at the paid tiers often isn’t activated unless someone deliberately turns it on.
On training: when was the last simulated phishing test? If the answer is “we’ve never done one” or “we did one a couple years ago,” that’s a gap. If the answer is “every few weeks, and we track click rates over time,” that’s a real program. The intermediate cases — annual training, no simulations — produce roughly the same outcome as no training at all.
If you’re missing two of the three, you’re in the same position as most small businesses. If you’re missing one, the gap is narrower but still meaningful. The specific exposure depends on which layer is missing, and identifying that exposure in your environment is the practical first step.
Getting an honest look at where you stand
Most small businesses don’t know which layer they’re missing because nobody has ever sat down and looked. The email provider’s default configuration is taken as adequate. The annual training video gets attributed more weight than it deserves. The DMARC record either doesn’t exist or exists in monitor-only mode that’s never been enforced. None of this is the business owner’s fault — these are configurations that live in DNS records and admin consoles most owners have no reason to touch.
ForeverOn‘s free security assessment includes a review of your email security posture across all three layers. Erik conducts the assessment in two visits: the first gathers data about your current configuration, the second presents findings visually — color-coded charts that show specifically which authentication records are in place, what your filtering catches and what it doesn’t, and where training gaps exist. The goal is to give you an accurate picture of where you actually stand, not a sales pitch.
For businesses that decide to address the gaps, ForeverOn’s managed IT services include email security and ongoing security awareness training with simulated phishing campaigns built into the Preferred and Total Care tiers. The 24/7 Security Operations Center monitors for compromise indicators across Microsoft 365 and Google Workspace tenants, which is the layer that catches what happens after a credential gets phished — the forwarding rule that quietly redirects financial correspondence, the new login from an unusual location, the OAuth grant that gives an attacker persistent access.
If you’d like to know where your email security has gaps before an attacker finds out for you, call ForeverOn at (301) 739-7311 or request the assessment online. A real person answers the phone. The conversation starts with what you have, not with what we want to sell.