Most breaches in a small office still start with a person, not a firewall. Someone opens a lookalike invoice, types a password into a fake Microsoft page, or approves a payment change because the email sounded urgent. Technical controls help. They do not replace a team that knows what to do when a message feels off.
We already cover the patterns in how to spot phishing emails. This note is about the briefing itself: how to run something useful for a Teesside or Durham team without turning it into a scare session nobody remembers.
Keep the session short and specific
An hour of slides about “cyber crime” washes off by lunchtime. Twenty minutes with three real-looking examples works better. Use a fake Microsoft 365 sign-in, a supplier asking you to pay a new bank account, and a delivery notice with a shortened link. Walk through what you would check: the actual From address, the URL behind the button, and whether anyone expected the message.
Tell people what good looks like. It is fine to telephone the supplier on a number you already have. It is fine to forward the message to whoever owns IT and get on with the day. It is not fine to punish someone for reporting a false alarm. If reporting feels risky, people will click quietly and hope.
New starters should hear this in the first week, not after they have already used email for a month. Pair it with the IT onboarding checklist so named accounts and MFA are in place before the first suspicious mail arrives.
Practise the boring checks
- Hover a link before clicking — on a phone, tap and hold so the address appears
- Read the domain, not only the display name. “Microsoft” in the From field is cheap to fake
- Treat unexpected password resets, MFA prompts and payment-detail changes as suspect until checked another way
- Use a shared mailbox or a named person for “is this real?” so the question has somewhere to go
- Remind people that IT will not ask for a password by email
You can do this around a table with a projector, or as a short Teams call for hybrid staff. Record nothing more sensitive than the examples. The point is repetition. A reminder in January and another before the summer holidays beats a certificate from a two-hour video that nobody finished.
What to do after someone clicks
A useful briefing includes the five minutes after a mistake, not only how to avoid one. If a password was typed into a fake page, change it from a device you trust, and assume the old one is burned. If MFA was approved in a panic, revoke sessions in Microsoft 365. If a payment detail was followed, stop and call the real supplier. Write those steps on one page next to the kettle. People will not search a policy PDF while they are embarrassed.
Tell the rest of the team if a campaign is doing the rounds — “we have seen fake DPD texts today” is enough. Do not name the person who reported it unless they are happy to be the example. The goal is that the next person forwards the mail instead of deleting it and hoping.
Technical measures still earn their keep. MFA stops many stolen passwords from being used. SPF, DKIM and DMARC make it harder for strangers to send mail that looks like yours — see SPF, DKIM and DMARC for small business email. Neither replaces the pause before a click.
Training platforms and who should run it
Some firms want a simple internal page or a short course they can assign when people join. That is a product problem as much as an IT one. We build staff training systems as custom apps when a slideshow in a shared drive is no longer enough. Most offices do not need that on day one. They need a script, a reporting address, and someone who will run the session twice a year.
Garvey's IT includes awareness in managed IT support — plain-English briefings, not a fear campaign. We also harden the mailbox and tenant so a missed click does less damage. Ask us to run a short session for your team in Stockton, Middlesbrough or further afield, or to review how mail is reported today.
Common questions
How often should a small team do phishing training?
A short session when someone joins, then a reminder a few times a year, is more useful than a long annual course. The aim is a habit: pause, check the sender, and ask before paying or resetting a password.
Do we need to send fake phishing emails to our own staff?
Not necessarily. Simulated phish can help a larger office measure who clicks. For a ten-person firm, a walkthrough of real examples and a clear way to report suspicious mail is often enough. If you do simulate, tell people afterwards what you found and never use it to embarrass anyone.