What actually moves the needle
Ordered by how much each changes the outcome rather than how easy it is to buy: phishing-resistant sign-in first, then sender authentication, then reporting speed, then everything else. Most organisations do this in the opposite order, starting with a gateway and an annual training video.
Layer one: stop the message being believable
- Publish and enforce DMARC at p=reject, with SPF and DKIM underneath it. This ends direct spoofing of your domain, which protects your customers and partners more than your own staff.
- Tag external mail visibly, so an internal-looking message from outside is obvious at a glance.
- Turn on link rewriting and time-of-click checking, accepting that it will miss campaigns gated behind a CAPTCHA or filtered by geography.
- Block or sandbox risky attachment types, and disable macros from the internet by policy rather than by request.
- Monitor for lookalike domain registrations and new certificates for your brand, which frequently surface a campaign before it is sent.
Layer two: make a successful lure worthless
This is the layer that changes outcomes rather than probabilities, because it removes the value of the thing the attacker just stole.
- Roll out passkeys or FIDO2 security keys. They are bound to the real site's origin, so a phishing page cannot obtain anything usable - see can phishing bypass MFA? for what the weaker methods do and do not survive.
- Enable number matching wherever push notifications remain, which closes the prompt-fatigue route.
- Require managed, compliant devices through conditional access, so a stolen session replayed elsewhere fails even though the token is valid.
- Shorten session lifetimes and enable continuous access evaluation, so a revocation actually takes effect.
- Restrict who can grant OAuth application consent, and review existing grants - a consent survives every password reset you will perform afterwards.
- Apply least privilege to mailboxes and finance systems, so one compromised account cannot approve a payment alone.
Layer three: make reporting fast and blameless
The measure worth tracking is not how few people click. It is how quickly the first person reports. A report in the first hour usually means a password reset; the same report the next morning can mean an incident.
- Put a one-click report button in the mail client, and make sure someone acts on what it produces.
- Never blame a reporter. One public reprimand will cost you every future report from that team.
- Train on the specific pretexts that actually reach your staff - the local bank, the local courier, the payroll change - rather than generic examples.
- Run realistic simulations to find where the gaps are, and follow a click with training immediately rather than at the annual review; the practicalities are in phishing tests for employees.
- Give finance a verification rule that does not depend on judgement: any change of bank details is confirmed by calling a number already on file. Two minutes closes most business email compromise.
- Write down what to do in the first hour after a suspected compromise, before you need it.