Contact us
Email security

Email security for business

We stop phishing, impersonation and invoice fraud before they reach your team, with layered protection we manage for you.
Book a free consultationCall 0755 999 999
  • GCIT ISO 27001 certification badgeISO 27001 certified
  • GCIT Microsoft Solutions Partner for Modern Work badge
A GCIT team member in glasses types at his desk, with a large monitor showing a forest wallpaper
The threat

How email attacks reach your business

Most email attacks target people, not systems. A convincing message asks someone to sign in, open a file or pay an invoice, and a spam filter on its own often lets it through.
19%of business cybercrime reports were email compromise with no money lost
15%were business email compromise fraud where money was lost
60%of the incidents reported to ASD’s ACSC involved phishing

Source: ASD’s Annual Cyber Threat Report 2024-25, financial year 2024-25. Email compromise and business email compromise fraud were the two most common cybercrimes businesses reported.

How invoice fraud usually plays out

01

A lookalike address

The attacker registers a domain one character away from a supplier’s, such as acmesuppIies.com.au, with a capital I in place of the l.

02

A believable thread

They write as the supplier. Sometimes they have taken over the supplier’s real mailbox and can quote real invoices and names.

03

New bank details

An urgent email says the bank account has changed and asks your accounts team to pay the next invoice to the new one.

04

The money moves on

Once it is paid, the money is moved on quickly and is hard to get back. A phone call to a known number before paying stops it.

Layered protection

Four layers of email security, managed by our team

No single product stops every email threat. Each layer catches what the others miss, and our team configures, monitors and tunes every one of them.

Filtering

Microsoft’s filters, set up properly

Anti-phishing policies with impersonation protection for your executives and key suppliers. Safe Links checks a link when it is clicked, and Safe Attachments opens files in a sandbox first. We set policies for each business and turn on automated investigation and response.

  • Microsoft Defender for Office 365
  • Exchange Online

Second scan

A second opinion on every email

Avanan connects by API and scans mail after Microsoft’s filters but before it lands in the inbox. It looks for advanced phishing, lookalike domains and account takeover that get past Defender, without slowing delivery.

  • Avanan (Check Point Harmony Email)

Authentication

Stop criminals sending as you

SPF, DKIM and DMARC prove an email really came from your domain. Without them, anyone can send email that looks like it came from your business. We set them up, check them continuously and get an alert when they fail.

  • SPF
  • DKIM
  • DMARC

People

Staff who check before they pay

Security awareness training and phishing simulations through the year. We track click rates, adjust the training to the results and teach staff to confirm any change to bank details by phone.

  • Huntress Managed Security Awareness Training
Ongoing management

Email security is not set and forget

Policies drift, new users miss a step and a DNS change can break a DMARC record. Our automation runs across every Microsoft 365 tenant we manage, puts settings back when they change and flags problems early.

One example: a DNS change broke a client’s DKIM signing, and their own emails started failing authentication. We found it through monitoring and adjusted their DKIM and Avanan settings so their mail was delivered again.

  • Mailbox settings enforced. External forwarding blocked, risky Outlook add-ins turned off and anti-spoofing rules in place, reset if anyone changes them.
  • Authentication watched. DMARC, SPF and DKIM checked continuously, with an alert when authentication fails.
  • Breached passwords caught. Accounts checked against Have I Been Pwned. If a user’s details appear in a breach, we reset the password and review their sign-ins.
  • Outside senders labelled. Every email from outside your organisation carries a warning, so impersonation is easier to spot.
  • Hidden inbox rules found. Attackers who get into a mailbox often add rules to hide their replies. We get an alert when a suspicious rule appears.
  • Multi-factor sign-in on every account. Enforced with Microsoft Entra ID Conditional Access, so a stolen password alone does not get an attacker in.
Questions

Frequently asked questions about email security

Spam filtering blocks bulk junk mail. Email security is broader. It protects against phishing, business email compromise, impersonation, malware attachments, credential theft and account takeover. Many of these emails contain no malicious link or file at all, just a convincing request. A spam filter will not catch a well written email that asks your accounts team to change a supplier’s bank details. That takes layered security with impersonation checks, domain monitoring and email authentication.

Defender for Office 365 is a strong first layer, and we set it up properly for every client. Avanan (Check Point Harmony Email) adds a second scan. It connects by API and checks each email after Microsoft’s filters but before it reaches the inbox, looking for advanced phishing, zero-day attacks and business email compromise that get past Defender. Think of it as a second pair of eyes on every email coming into your business.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that fails SPF or DKIM checks. Without DMARC, anyone can send email that appears to come from your domain. With a DMARC policy set to “reject”, spoofed email is blocked before it reaches the recipient. We set up and monitor DMARC for every managed client.

Defender and Avanan alert our team as soon as they detect a threat, and Conditional Access policies limit what an attacker can do with a stolen password. Half of all support tickets had a GCIT technician working on them within 12 business minutes of being logged (20 Jul to 11 Oct 2026). We handle the whole incident: containment, finding the cause, fixing it, resetting credentials and a clear summary of what happened and what we did.

Yes. Most cyber insurance applications ask about email security controls: multi-factor sign-in, anti-phishing policies, DMARC status and security awareness training. Having these controls in place and documented makes those questions easier to answer. Read our client stories for examples.

Yes. Email security is managed remotely, so we look after businesses across the Gold Coast, Brisbane, Tweed Heads and Northern NSW. Our Essential Eight compliance and security assessment services are also available remotely.

Our team is alerted through Defender and Avanan. If someone clicks a malicious link, Conditional Access and endpoint protection add further layers of defence. We check how far it went, reset credentials if needed and give you a clear incident report.

Our main stack is built on Microsoft 365, and Avanan also supports Google Workspace. If your business uses a different email platform, talk to us about the options. We can set up SPF, DKIM and DMARC for any domain, whoever hosts your email.

Reviewed by Elliot Munro, CISO at GCIT.

Get in touch

Get an email security review for your business

Tell us about your current setup. We will review your Defender policies, DMARC status and anti-phishing settings, and show you where the gaps are. The review is free and takes less than an hour.
Call 0755 999 999Contact us
Monday to Friday, 8am to 5pm Queensland and NSW time.
Sales
0755 999 999
Support for existing clients
1300 369 111
Email
hello@gcit.com.au
Office
1/16 Dover Drive, Burleigh Heads QLD 4220
ISO 27001  |  ISO 9001  |  ISO 14001  |  Essential Eight assessment certified (TAFE Queensland)  |  Microsoft Solutions Partner
Ready to secure and simplify your IT? Talk to a GCIT expert today.
Sales 0755 999 999 Book a free consultation