Discuss your project
Cybersecurity

Email security

Email is still the most common attack route, and invoice fraud from a spoofed or compromised mailbox can cost more than ransomware. We secure Microsoft 365 and Google Workspace, protect your domain and simplify staff reporting.

Discuss your project How the work is delivered

A good fit if

  • Staff get convincing phishing, or suppliers were tricked by emails that looked like yours.
  • A mailbox was compromised, or a fake banking change redirected a payment.
  • You have no DMARC record, nobody monitors it, or your mail lands in spam.
  • You use Microsoft 365 or Google Workspace but never reviewed its security settings.

What is included

  • SPF, DKIM and DMARC for every service sending as you
  • Filtering and sandboxing of links and attachments, built-in or gateway
  • Impersonation and lookalike-domain protection for executives and key suppliers
  • MFA on every mailbox, legacy sign-in blocked, risky-change alerts
  • Report-phishing button, reviewed reports and a payment-verification procedure

What this service is

Email security protects staff inboxes from phishing and malicious attachments, and your domain's reputation from criminals posing as you. We use Microsoft 365 and Google Workspace protection, plus a gateway where needed, as a one-time project or ongoing managed security. For managed-service clients, alerts, DMARC reports and reported messages are reviewed as part of 24/7 monitoring, with regular reports and response targets set in the service agreement.

Five practices cut most email risk:

  • Authenticate your domain
  • Filter links and attachments
  • Protect every mailbox
  • Verify payment changes by phone
  • Train staff and make reporting easy
More detail and warning signs
  • Major mailbox providers expect authentication from bulk senders; it also helps real mail get delivered.
  • Filtering flags outside senders and lookalike domains; staff who report are thanked and acknowledged.
  • Warning signs: clients see odd emails from you; phishing found only after a click; your newsletter tool asks for domain authentication; unexplained outside forwarding; sign-ins without MFA or through older apps.

Business email compromise

An attacker uses a stolen password to enter a real mailbox, watches conversations, then asks at the right moment to change payment details. From a genuine account, it can pass filtering; MFA, sign-in monitoring, mailbox-rule alerts and payment checks reduce the risk.

Suspect a compromise? Tell your bank at once about payments in progress, and your insurer. If personal data may be exposed, the Nigeria Data Protection Act 2023 expects the controller to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach likely to risk people's rights and freedoms, and to tell affected people without undue delay where the risk is high. This is not legal advice.

Data protection and wider security

Email carries personal and confidential information, so we help set rules for external sharing, encrypting sensitive messages and retention, in line with your data protection obligations (compliance readiness). EDR catches malicious files that reach a device; see also Microsoft 365 management and all cybersecurity services.

Delivery

How the work is delivered

  1. Review

    Mail flow, filtering, mailbox settings, domain records and signs of past compromise.

    Output: Prioritised findings.

  2. Authenticate the domain

    SPF and DKIM for every legitimate sender, then DMARC in monitoring mode.

    Output: Domain records, DMARC reports.

  3. Harden mailboxes

    Enforce MFA, block legacy sign-in, tighten forwarding and sharing, alert on risky changes.

    Output: Hardened setup, change log.

  4. Enforce and train

    DMARC to quarantine or reject once reports are clean; staff shown how to report.

    Output: Enforced DMARC, staff guidance.

Scope at a glance

Not included unless agreed

  • Licences and mailbox migrations, billed or scoped separately
  • Recovering lost funds, a matter for bank, insurer, police
  • Legal advice on email retention or e-discovery

What we need from you

  • Admin access to your email platform and domain DNS
  • A list of every service sending as your domain
  • Named approver for mail-flow changes; staff time for MFA setup

Before handover

  • Every real sender authenticated before DMARC enforcement, so mail keeps flowing.
  • Test messages prove filtering, authentication and reporting work.
  • Forwarding reviewed; every change recorded with its reason.

What affects the cost

  • Mailboxes, domains and third-party senders
  • Built-in protection or an added gateway
  • Past compromise needing investigation
  • Ongoing monitoring or a one-time project

No package prices: estimates in naira from an agreed scope, taxes shown separately.

Questions buyers usually ask

What are SPF, DKIM and DMARC?

DNS records that prove mail came from your domain. SPF lists approved senders, DKIM signs messages, and DMARC sets what happens on failure and reports back. Together they make spoofing much harder.

Will enforcing DMARC break our email?

Not if staged. We monitor first, fix every service sending as your domain (newsletter, invoicing or CRM tools), then enforce.

Is Microsoft 365 or Google Workspace secure by default?

Both include solid protection, but key settings are optional or licence-dependent. A review usually finds quick wins, such as blocking legacy sign-in or alerting on external forwarding.

How do we stop invoice fraud?

A process beats technology here: before any banking change, phone a number you already have, never one in the email. That stops most invoice fraud; we help write and roll out the procedure.

Worried about phishing or invoice fraud?

Tell us which email platform you use and what has happened so far. We will reply to arrange a conversation.

Discuss email security