Phishing Is Getting Harder to Spot. Here Is How to Button Up Your Firm.

Thirteen Controls, Most Important First.

Controls marked Insurers ask commonly appear on cyber insurance applications. The first three address the losses we hear about most often.

1. 01

   Turn on MFA for every email account Insurers ask

   Every user, including owners, part timers and shared mailboxes. In Microsoft 365 the free security defaults do this. In Google Workspace it is 2-Step Verification. No exceptions for the person who finds it annoying. [6][4][12][13]

2. 02

   Call back before any payment change

   Any new bank details from a client, consultant or vendor get a phone call to a number you already have, not one in the email. Make it a written rule nobody can skip, including for urgent requests from the boss. [2][8][3]

3. 03

   Two people approve every wire and new payee

   One person sets up the payment, a second approves it. Fraud works on one rushed person. It rarely gets past two. [2][3]

4. 04

   Block old sign in methods

   Old email protocols such as IMAP, POP and basic authentication skip MFA entirely. Microsoft’s security defaults block them. Ask your IT provider to confirm they are off. [4]

5. 05

   Use stronger MFA for admins and whoever pays the bills

   Text message codes and simple “approve” pushes can be phished. Passkeys and security keys cannot. Start with admin accounts and the people who move money. Until then, use number matching in the authenticator app. [7][10][12][4]

6. 06

   Back up so ransomware cannot reach it Insurers ask

   Automatic, encrypted backups with at least one copy offline or unchangeable, and a test restore on the calendar. Cloud sync alone is not a backup: deleted or encrypted files sync too. [9][13]

7. 07

   Put EDR on every computer Insurers ask

   Endpoint detection and response watches laptops and servers for attack behavior and can isolate a machine. Ask who watches the alerts after hours. [13]

8. 08

   Keep admin rights rare and separate Insurers ask

   Few people with admin rights, each with a separate admin account they do not use for email, plus a locked away emergency account. A phished everyday account then cannot take over everything. [4][13]

9. 09

   Install updates automatically Insurers ask

   Computers, servers, firewalls and remote access tools. Replace anything that no longer gets security updates. [9][13]

10. 10

    Filter email and flag outside senders Insurers ask

    Use the filtering in your email platform or a dedicated service, mark external emails with a banner, and block automatic forwarding to outside addresses. [13]

11. 11

    Train people, and make reporting easy Insurers ask

    Short training and practice phishing emails during the year, and one button or address for “this looks off.” Good grammar no longer means an email is safe, because AI writes clean emails. [8][13]

12. 12

    Long passwords, a password manager, no forced resets

    Current federal guidance is long, unique passwords checked against known breached passwords, and no forced changes on a schedule. A password manager makes that possible. [10][8]

13. 13

    Write a one page plan Insurers ask

    Who calls the bank, who calls the insurer, who calls IT, and where those numbers are kept off the network. Test it once a year. [13][1]