CybersecurityEmail Security
Stop phishing, fake boss and fake supplier emails (BEC) and malicious attachments with filtering, SPF/DKIM/DMARC and sandboxing.
What we usually find on site
Email is still one of the main ways in. The kind that costs the most money has no malware at all: a message that looks like it's from your supplier in Thailand or China saying "we've changed our bank account". And a domain without DMARC is easy for someone else to send as, straight to your customers.
We split the job into three layers.
1. Protect your own domain
Set up SPF, DKIM and DMARC correctly, then move DMARC from p=none to quarantine and reject based on the reports. This usually takes several weeks, because you have to find every system that sends mail as you: the accounting package, the scanner, the HR system. Skip that step and your real email gets blocked.
2. Filter inbound mail
A secure email gateway, or an API-connected service for Microsoft 365/Google Workspace, filters spam, phishing and malicious links (re-checked at click time) and opens attachments in a sandbox before users see them. Good platforms also catch link-less BEC by looking at language and sender behaviour.
3. People and process
"External email" banners, a report-phishing button, and one rule: any change to a supplier's bank details is confirmed by phone on a number you already have. That last one costs nothing and stops more of this fraud than anything else. In offices that mix Lao, Thai and English, a fake email with slightly odd wording is harder to spot.
What it does
SPF, DKIM and DMARC
Set up and driven by reports all the way to p=reject.
Anti-phishing and BEC
Catches executive impersonation and look-alike domains.
Attachment sandboxing
Opens files somewhere safe before delivery.
Time-of-click link checks
Catches links that were clean on arrival and turned bad later.
Microsoft 365 / Google Workspace
Via API or MX, no change of mail platform.
Report button and clawback
Pulls a bad message out of every inbox at once.
Design and rollout
- 1
Audit DNS, domain settings and the current mail platform
- 2
Turn on SPF/DKIM and DMARC p=none to collect reports
- 3
Connect filtering via API or MX
- 4
Tune policy; turn on banners and the report button
- 5
Move DMARC to quarantine, then reject
Where it fits
- Finance teams receiving invoices from Thai and Chinese suppliers
- Banks whose domains get spoofed to fool customers
- Government agencies that want people to trust their email is genuine
- Import/export firms doing deals with foreign partners by email
Typical system sizes
Domain Protect
Fits: Where every organization should start
- SPF, DKIM and DMARC setup
- DMARC report analysis
- Turn on the security already in M365/Google
Advanced Filtering
Fits: 20–500 mailboxes
- API or gateway email security
- Sandboxing and time-of-click protection
- BEC protection and report button
Complete
Fits: High-risk organizations
- Advanced filtering plus phishing simulations
- DMARC p=reject with ongoing monitoring
- A written payment-verification procedure
Brands we supply & install
All brand names and trademarks belong to their respective owners. Mention does not imply official partnership unless explicitly stated. Products are sourced through legitimate distribution channels.
FAQ
What is DMARC and do I need it?
DMARC tells receiving servers what to do with mail that claims to be from your domain but fails SPF/DKIM. Since 2024 Gmail and Yahoo require it of bulk senders. Every organization should have it.
Microsoft 365 already filters email. Do I need more?
The baseline protection (EOP) is reasonable. Defender for Office 365 or a third-party layer adds sandboxing, link checks and better BEC defence. For finance staff and executives, we'd add it.
How do we stop payment-fraud emails?
Technology helps, but process matters more: every supplier bank-detail change is confirmed by phone using the number already on file, never the one in the email.
Related guides
SPF, DKIM and DMARC: Stop People Sending Mail as Your Domain
The three DNS records that tell the world which mail is really yours. Working examples for Microsoft 365 and Google Workspace, and a path to p=reject without losing your…
Phishing: A Guide for Every Employee, and for Whoever Runs the Training
The signs that an email, WhatsApp message or phone call is a scam, what to do after a wrong click, and how to run trilingual training people don't tune out.
Microsoft 365 or Google Workspace: How Does Your Organisation Actually Work?
Email, documents, collaboration, security and device management compared, plus what to check before migrating, starting with who controls your domain's DNS.
Ransomware Checklist: Breaking the Attack at Each Stage
Ransomware is not a one-minute event. A checklist organized around the stages attackers actually go through, plus what to do in the first hour.
Related solutions
Cybersecurity
Next-Generation Firewall (NGFW)A firewall that knows which app and which user, with IPS, web filtering, HTTPS inspection and VPN, sized on real all-features-on…
Secure Remote Access (VPN/ZTNA)Staff and contractors reach internal systems from anywhere through VPN or ZTNA with MFA, seeing only what they need.
Endpoint Protection & EDREDR that watches behaviour, not just virus lists. It stops ransomware mid-run and cuts an infected PC off the network at once.
Zero Trust & Network Access Control (NAC)Check every user and device before it joins, with 802.1X and NAC. Plugging into a LAN port no longer means reaching the servers.
SOC & SIEM MonitoringFirewall, server and endpoint logs in one SIEM, with people watching the alerts and a clear plan for when something happens.
Vulnerability Assessment & Penetration TestingScan and test systems, websites and networks to find weaknesses before someone else does, with a report ordered by what to fix…Send us a floor plan or a few photos of the site
We’ll come back with a few questions, then a first design. The first consultation is free, in Lao, Thai or English, on WhatsApp or our Facebook page.