Detecting phishing before it reaches your employees

Most of the phishing that reaches a real inbox is not clever. It is a lookalike domain, a fake invoice, or a message impersonating a vendor the company already uses. What makes it work is speed: it lands, someone clicks before anyone reviews it, and the damage is done in minutes.

Here is the layered setup we install for companies between 20 and 200 people, in the order we install it and roughly what each layer catches.

Layer 1: DMARC, DKIM and SPF, enforced not just monitored

Half the companies we audit have SPF and DKIM configured but DMARC set to p=none, which logs spoofing attempts without blocking them. Moving to p=quarantine after two weeks of monitoring is the single highest-leverage change most companies can make, and it is free.

Layer 2: A secondary filter, not just your email provider's default

Google and Microsoft's built-in filtering catches known bad senders well and lookalike domains poorly. A secondary filter tuned for brand impersonation catches a category the primary filter consistently misses. We see it stop 15-20% of what the primary filter lets through.

Layer 3: A reporting button that actually gets used

The Report Phishing button only works if reporting is faster than not reporting. We measure median time-to-report; anything over 90 seconds means the button is buried and needs to move.

• Run a baseline phishing simulation before making any changes, so you have a number to improve against.

• Reward reporting publicly; never publicly call out someone who clicked.

• Review quarantined mail weekly — false positives erode trust in the whole system faster than misses do.

What this does not fix

None of this stops a targeted attack against one specific person who is determined to be fooled. That requires the training piece, which is a separate article. This layer is about the volume attacks that hit everyone, and it closes most of that gap for the cost of a few hours of setup.