Most small businesses already own decent email filtering, and they still get hit. The gaps that let attackers through in 2026 sit between the filter and the person reading the message: authentication records published but never enforced, payment changes approved without a phone call, a reporting path that takes hours, forwarding rules nobody has audited since 2023, and no practiced response for the hour after a click. This email security guide walks each of those five gaps in the order they cost money, and the fix for four of them is configuration and process rather than another product license. Our team closes most of this in under a month for a 50-person company.
The Five Gaps at a Glance
Here is what we find on nearly every SMB email assessment we run, and what each gap actually costs when it goes unaddressed:
- Authentication left half-finished. SPF and DKIM get published, DMARC gets set to
p=none, and nobody comes back to move it to quarantine or reject. Attackers keep spoofing the domain because nothing tells receiving servers to refuse the mail. - No out-of-band callback on money movement. Wire and ACH detail changes get approved inside the email thread where the request arrived. This single missing step is how most business email compromise losses land.
- A reporting path measured in hours. Staff forward suspect mail to a shared inbox that someone checks after lunch. Containment windows for a stolen session token are minutes, not hours.
- Forwarding and delegate rules nobody audits. Attackers who get a session set up an auto-forward, then leave. Access looks closed, mail keeps flowing out for months.
- No rehearsal for the hour after a click. Teams that have never practiced revoking sessions and resetting tokens improvise under pressure, and improvisation costs hours.
Read this if you run IT for a company between 10 and 500 people, own security as part of a broader operations role, and already pay for filtering that keeps letting things through.
Why Most Email Security Guide Advice Fails Small Businesses
Generic email security advice fails SMBs because it assumes a security team exists to operate the controls it recommends, and in a 50-person company nobody owns that operating work. The top-ranking guides list gateways, antivirus, encryption, and training, which are the right categories. They stop at the category. What we see in the field is a client with all four categories bought and none of them finished.
Buying Controls Is Not The Same As Operating Them
The case for the buy-first approach is real: a modern gateway does stop the volume, and it stops it on day one without staff behavior changing. Filtering catches the commodity malware and the bulk credential harvesting, which is most inbound volume by count. Against that, the attacks that produce actual losses at SMB scale are low volume and hand-written, and they arrive from a legitimate, already-compromised partner mailbox where there is no attachment and no bad link to detect. A gateway has close to nothing to inspect. Both readings hold at once. Filtering is necessary and it is not the layer that stops the expensive attacks, which is why the gaps below are process gaps.
AI Has Removed The Tells Staff Were Taught To Spot
Awareness training built on typos and awkward grammar is aging badly. Generated phishing now matches a vendor’s register, references a real invoice number pulled from a compromised thread, and arrives on the right day of the month. The counterargument deserves a fair hearing: trained staff still report far more than untrained staff, and reporting rate is the metric that predicts containment speed. That is true, and it means training should shift its target. We now train on process triggers rather than cosmetic tells, teaching staff that a payment detail change requires a callback no matter how clean the message reads. Our breakdown of the threats generated phishing brings in 2026 covers where the old tells have gone.
The 5 Gaps in an SMB Email Security Guide, Ranked by Cost
The five gaps below are ordered by the dollar loss we have watched each one produce, and every fix is something an internal admin can complete without a new vendor. Work them top down.
Gap 1: DMARC Published But Never Enforced
DMARC at p=none tells receiving mail servers to report on spoofed mail and deliver it anyway, which stops nothing. Most SMBs we audit are sitting there, often for two years, because the move to p=quarantine feels risky. The caution is fair. A premature jump to reject can break a payroll platform or a marketing sender that was never included in SPF. The route through is the aggregate reports the p=none phase produces: read them, add every legitimate sender, then move to quarantine at 25 percent and step up. Our team usually finishes this in three weeks of reporting plus two configuration changes.
Gap 2: Payment Changes Approved Inside The Email Thread
An out-of-band callback on every banking detail change is the highest-value control an SMB can add, and it costs nothing. Business email compromise does not need malware. It needs a plausible request from a real address at the right moment. Some finance leads push back that a callback rule slows vendor onboarding, and it does add a day. Weigh that against the average wire loss and the argument closes itself. Use a phone number from your own vendor record, never a number in the request, and log the call. We walk through the full pattern in our guide to preventing business email compromise.
Gap 3: A Reporting Path Nobody Can Use In Under A Minute
Report-suspicious-message buttons belong in the mail client, wired to a monitored queue, because the containment window for a stolen session is measured in minutes. The shared mailbox pattern fails quietly: staff do report, and the report sits. Meanwhile a stolen token is being used. There is a counterweight worth naming, since a one-click button raises false positives and someone has to triage them. That triage load is the point of a monitored service. Ours runs through managed security services, and pairing the button with security awareness training is what moves reporting rate. If your staff still need the visual cues, how to spot a phishing email is the piece we hand to new hires.
Gap 4: Forwarding And Delegate Rules Nobody Has Audited
Auto-forward and mailbox delegate rules are the persistence trick attackers leave behind after the password reset, and almost no SMB reviews them on a schedule. The attacker gets one session, creates a rule that copies anything matching “invoice” to an outside address, and leaves. Password changed, MFA re-enrolled, mail still flowing out. We saw exactly this play out in an email account compromise we contained in minutes. Block automatic external forwarding at the tenant level, alert on new rule creation, and review delegates quarterly. Where mail carries regulated or client-confidential content, pair the rule audit with email encryption so a copied message is not a readable one.
Gap 5: No Rehearsed First Hour After A Click
Write down the first hour: revoke sessions, reset credentials, pull mailbox rules, check sent items, notify finance to freeze pending payments. Then practice it once. Teams that skip the rehearsal argue that a written runbook is enough, and for a linear task it often is. Session revocation is not linear. It touches identity, mail, and endpoint at the same time, and the order matters because a reset password without a session revoke leaves the attacker logged in. One tabletop exercise a year surfaces the ordering mistakes. A scheduled cybersecurity audit is where we usually run it.
Frequently Asked Questions
What should an email security guide cover for a small business?
An SMB email security guide should cover filtering, authentication enforcement, a fast reporting path, mailbox rule auditing, payment verification process, and a rehearsed response plan. Filtering alone leaves the four process gaps open. Our team treats the process items as the higher priority because they stop the attacks that carry the largest dollar loss.
Is DMARC worth setting up for a company with 50 employees?
Yes, and the work is smaller than most owners expect: two DNS records, three weeks of report review, then a staged move to quarantine. Domain spoofing does not scale down with company size, and a spoofed invoice from your own domain damages vendor trust immediately.
Does multi-factor authentication stop business email compromise?
Multi-factor authentication stops password reuse attacks, and it does not stop the request-based fraud that drives most business email compromise losses. Attackers using a genuinely compromised partner mailbox are already past MFA. The control that stops that request is an out-of-band callback before any payment detail changes.
How often should we audit mailbox forwarding rules?
Quarterly for a full review, with real-time alerting on new rule creation in between. Attackers create the rule during the session they hold and then go quiet, so a calendar-only review can leave a copy running for a full quarter before anyone notices.
Can we run this email security guide without hiring a security team?
An internal admin can complete four of the five fixes: the DMARC staging, the forwarding block, the payment callback policy, and the runbook. The item that genuinely needs coverage is the monitored reporting queue, because a report that arrives at 2 a.m. has to reach somebody who can revoke a session.
Get Your Email Gaps Mapped in One Session
Everything above is work an SMB can own, which is exactly why it stays unfinished: it belongs to nobody’s job description until an invoice gets paid to the wrong account. The pattern we see holds steady across client sizes. The companies that avoid the expensive email incident are not the ones with the most filtering. They are the ones that finished the DMARC move, made the callback non-negotiable in finance, put a one-click report button in front of every employee, and practiced the first hour once. That is a month of focused work, not a capital project.
If you want to know which of the five gaps are open in your tenant right now, our team will walk your authentication records, forwarding rules, and reporting path with you and hand back a prioritized list. Book a free strategy call and we will map it in one session.
Written by Kent, Mindcore Technologies.
