CyphrQ
Menu

AI Phishing Protection for Small Business: The 30-Day Plan

AI made phishing fluent, personal and cheap. What protects a small business now, in order of impact, from passkeys to payment rules, with a 30-day plan.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Updated 13 min read

AI phishing protection for a small business comes down to making the click not matter: phishing-resistant sign-in (passkeys or security keys), a written rule that every payment change or password request is verified on a second channel, email authentication on your domain, and a reporting culture with no blame. Training to spot typos is no longer the main defence.

Phishing is a message that pretends to come from someone you trust so that you hand over a password, approve a payment or open something harmful. AI has not changed what phishing is. It has changed how good, how personal and how cheap it is.

How has AI changed phishing?

Four things are different from the phishing most of us were trained on.

  1. It is fluent. The UK's National Cyber Security Centre (NCSC) assessed in January 2024 that generative AI lets attackers write convincing lures "without the translation, spelling and grammatical mistakes that often reveal phishing."
  2. It is personal. A model can read your website, your LinkedIn page and a supplier's public posts, then write a message that mentions the right project, the right colleague and the right invoice. The NCSC's view is that AI gives attackers an uplift in reconnaissance and social engineering, "almost certainly making both more effective, efficient, and harder to detect."
  3. It is in any language. A scammer no longer needs Arabic, German or Hindi to phish your Dubai, Munich or Mumbai office.
  4. It scales. An afternoon of skilled work per target is now seconds of scripting, so small businesses once below the effort threshold are worth the attacker's time.

Cloned voices and deepfake video calls are the same trend on phone and video, covered in Deepfake Scams: How to Spot Them When Your Eyes and Ears Can't. This post covers email, chat and SMS.

Why doesn't "spot the typo" training work any more?

Most phishing awareness training taught people to look for bad grammar, odd greetings, a mismatched sender name and a sense of urgency. The first three were always signs of low effort, not signs of phishing. AI has removed the low effort.

The NCSC made this point before AI forced it. Its guidance Phishing attacks: defending your organisation says training cannot teach everyone to identify every phishing email, that targeted spear phishing will get through, and that relying on user vigilance alone wastes time and money. It also warns against punishing staff who click simulated phishing, because that discourages the reporting you need.

Well-trained, careful people still click a good spear-phish, because a good spear-phish is designed for that person on that day. Expecting humans to be the filter was never a plan. With AI on the other side, it is not even a hope.

The useful reframe: assume some messages will be convincing and some will be clicked. Then build the business so that a click does not become a loss.

What AI phishing protection works for a small business, in order of impact?

The NCSC structures phishing defence in four layers: make it hard for attackers to reach users, help users spot and report, limit the damage of a successful click, and respond quickly. The items below cover all four, ordered by how much risk each one removes for the effort.

# Control What it stops Cost Week in the plan
1 Phishing-resistant MFA (passkeys or security keys) A stolen password or relayed code being used to sign in Passkeys are free with most providers; security keys are a one-off purchase per person 2
2 Verification rules for payments and credentials, plus dual approval above a threshold Money sent to a fraudster's account; codes or passwords handed over Free 1
3 SPF, DKIM and DMARC on your domain Criminals sending mail that looks like it comes from you Free, plus an afternoon of your IT partner's time 3 and 4
4 Reporting culture with no blame Slow discovery of an attack that is already under way Free 1 and 4
5 Business password manager Password reuse; autofill on look-alike sites A few dollars per user per month 3
6 Automatic updates and basic hygiene Attachments and links that exploit unpatched software Free 4

1. Phishing-resistant MFA: passkeys or security keys

Multi-factor authentication (MFA) means a password alone is not enough to sign in. Not all MFA is equal. A six-digit code from an app or SMS can be phished: the fake site asks for it and relays it to the real site within seconds. A tired person can approve a push notification at the wrong moment.

Phishing-resistant MFA is a sign-in method that cannot be relayed through a fake website, because there is no code to type and nothing for the fake site to pass on. The most practical form for a small business is a passkey (the standard behind it is FIDO2 or WebAuthn).

In plain terms: your phone or laptop holds a private key that never leaves the device. You unlock it with your fingerprint, face or PIN, and the device proves to the real website that it has the key. A fake website cannot use a passkey created for the real one, so there is nothing to type and nothing to steal. Google says passkeys "provide the strongest protection against threats like phishing" because they are stored on your device and "cannot be guessed or reused" (Google Safety Center).

A hardware security key (a small USB or NFC device) is the same idea in a separate object, useful for the owner, the finance lead and anyone with admin rights. The US Cybersecurity and Infrastructure Security Agency (CISA) explains the options in Implementing Phishing-Resistant MFA. If you change only one thing after reading this post, turn on passkeys or security keys for email, your accounting system and your bank.

2. Verification rules for money and credentials

The expensive outcome of a phishing email is usually not the stolen password. It is a payment sent to a new account because an email asked nicely. The FBI's Internet Crime Complaint Center counted about $20.9 billion in reported losses across all complaint types in its 2025 Internet Crime Report. Business email compromise, where an email talks a company into paying the wrong account, was the second-largest category at about $3.05 billion. Phishing itself does not appear in the top five categories by loss. Plan for the payment, not just the password.

Write two rules, print them, and apply them to everyone including the owner:

  • Any new payee or change of bank details is confirmed by phone, on a number already on file, by someone other than the person who received the request. Not the number in the email. Not a reply to the email.
  • No one asks for a password, MFA code or remote access by email or chat, and no one gives one. IT, the bank and the software vendor will never need your code. Anyone who does is the attack.

Above an amount you set, any payment or bank-detail change also needs a second person to approve it.

Add "urgent" and "confidential" to the list of reasons to slow down rather than speed up. If the request comes by phone or video call instead, the rule still applies; the deepfake guide covers the call-back habit for voice and video.

3. Email authentication: SPF, DKIM and DMARC

Three settings on your domain decide whether other mail servers will accept email that claims to be from you.

  • SPF (Sender Policy Framework): a list of which servers are allowed to send mail for your domain.
  • DKIM (DomainKeys Identified Mail): a signature on each message so the receiving server can tell it was not altered in transit.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance): a policy that tells the receiving server what to do when a message fails those checks (monitor, quarantine or reject), and sends you reports.

Set up all three, and move DMARC to quarantine or reject once the reports show your real mail passes. That stops criminals sending mail as your domain to your customers and suppliers. The NCSC's phishing guidance asks organisations to adopt all three and to encourage their contacts to do the same.

4. A reporting culture with no blame

The NCSC's guidance is blunt about this: a culture of punishment or blame discourages reporting, and reports are your early warning. Make reporting one click or one address, say thank you every time, and tell people what happened to their reports. Someone who clicked and reported within five minutes has done you a favour; treat them that way, in public. Measure reporting rate, not just click rate.

5. A password manager

A password manager gives every account a different, strong password, and the good ones will not autofill on a site whose address does not match. When it refuses to fill in the "Microsoft" login page, that is your signal. The NCSC's phishing guidance recommends them. Pay for a business plan so you can offboard people and recover accounts.

6. Patching and basic hygiene

Some phishing wants you to open a file or page that exploits an unpatched browser or document reader. Turn on automatic updates for operating systems, browsers and office software, and remove software nobody uses. CISA's joint guidance with the NSA, FBI and MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One, has a section for small and medium-sized businesses worth handing to whoever runs your IT.

What is a realistic 30-day plan?

  1. Week 1: decide and write. Write the two verification rules (payment changes, credentials) on one page, with the amount above which a second person must approve. Tell the team why, mentioning that AI phishing no longer has typos. Pick a reporting address or button.
  2. Week 2: lock the front doors. Turn on passkeys or security keys for the owner, finance, and anyone with admin rights, on email, accounting and banking. Move everyone else off SMS codes to an authenticator app as a minimum, with passkeys as the goal.
  3. Week 3: fix the domain. Ask your email provider or IT partner to set up SPF, DKIM and DMARC in monitoring mode and send you the first report. Roll out a business password manager.
  4. Week 4: close the loop. Review the DMARC report and move to quarantine. Confirm automatic updates are on everywhere. Run a short, no-blame session: show the team two real examples of fluent AI phishing and practise reporting, not spotting.

Then repeat the question every quarter: if a convincing email reached the right person tomorrow, what would stop the money or the password leaving?

Going deeper: for security and IT teams

Threat model. Business email compromise crews want a live session in a mailbox that handles invoices, or a domain a supplier will trust. The prize is a redirected payment. In practice: IBM's 2026 Cost of a Data Breach findings for the Middle East name phishing, including voice and SMS, as the initial vector in 18% of incidents in the region, at an average cost of $10.41 million, against a regional average breach cost of $8 million (IBM Middle East, August 2026). The global average in the same report is $4.99 million, for breaches between March 2025 and February 2026 (IBM, July 2026).

Why code-based MFA loses to adversary-in-the-middle. An adversary-in-the-middle (AiTM) kit is a reverse proxy holding one TLS session with the victim and one with the real sign-in page; it relays the password and MFA step and keeps the session cookie. Microsoft documented a campaign that attempted to target more than 10,000 organisations from September 2021. Payment fraud began as little as five minutes after a cookie was stolen, and the attacker hid supplier replies with an inbox rule that moved them to Archive and marked them read (Microsoft Threat Intelligence, July 2022). In MITRE ATT&CK the lure is T1566 Phishing (.001 attachment, .002 link, .003 via service, .004 voice). T1557 lists evilginx2 capturing session cookies. A passkey or FIDO2 key is bound to the real site, so the proxy's domain gets nothing it can relay.

Identity controls, as Microsoft documents them for Entra ID tenants:

  • Phishing-resistant methods (FIDO2 or certificate-based authentication) for admins and finance first.
  • Conditional Access that requires a compliant device or trusted IP, so a cookie replayed from the attacker's machine fails, plus Continuous Access Evaluation to revoke sessions when conditions change.
  • Token Protection, a Conditional Access session control that accepts only device-bound sign-in session tokens such as Primary Refresh Tokens. It covers native apps for Exchange Online, SharePoint Online and Teams; browser support is a limited preview for Azure Resource Manager only, so browser sessions to Outlook on the web are not yet covered. Pilot it in report-only mode.
  • Number matching is now on for all Authenticator push notifications. It stops blind approvals. It does not stop a proxy that captures the session whatever method was used.

Mail authentication details. RFC 7489 DMARC passes only when SPF or DKIM passes for a domain aligned with the visible From domain. Alignment is relaxed by default (adkim=r, aspf=r, same organisational domain); strict needs an exact match. The usual failure is a SaaS sender passing SPF on its own bounce domain; have each vendor DKIM-sign as your domain. Go p=none with a rua address, fix every legitimate stream, then quarantine, then reject, with sp= covering unused subdomains. The RFC Editor now marks RFC 7489 obsoleted by RFCs 9989-9991; check which your tooling implements. RFC 7208 §4.6.4 caps SPF at 10 DNS-querying terms (include, a, mx, ptr, exists, redirect) across nested includes; one more returns permerror. Rotate DKIM selectors on a schedule and whenever a sending vendor leaves. Since 1 February 2024, Google has required senders of more than 5,000 messages a day to Gmail to publish DMARC, with From aligned to SPF or DKIM. p=none satisfies Gmail; it does nothing for your brand.

Detection. Microsoft's write-up lists the signals worth an alert: suspicious inbox manipulation rules, impossible travel, activity from an infrequent country, anomalous tokens, unfamiliar sign-in properties for session cookies, and one session ID reused from another country. Add new external forwarding rules and new OAuth app consents to the same queue.

Ask your IT partner: which accounts can still sign in without a phishing-resistant method? What share of last month's mail passed aligned DMARC? How many SPF lookups does our record use? Who receives the inbox-rule alert, and how fast do they act?

Key takeaways

  • AI made phishing fluent, personalised, multilingual and cheap. Typos and bad grammar are no longer a reliable sign, according to the UK NCSC.
  • Training people to spot phishing helps, but it cannot be the main control. Build so that a click does not become a loss.
  • In order of impact: phishing-resistant MFA (passkeys or security keys), written verification rules for payments and credentials, SPF/DKIM/DMARC on your domain, a blame-free reporting culture, a password manager, and automatic updates.
  • A passkey cannot be phished because the private key never leaves your device and only works with the real site.
  • Thirty days is enough to put all of this in place for a small business, most of it at no cost beyond time.
  • For IT teams: code-based MFA does not stop adversary-in-the-middle cookie theft. Pair phishing-resistant sign-in with device-based Conditional Access, take DMARC to p=reject, and alert on new inbox rules.

Sources