A finance director receives an email apparently sent by a supplier they have used for years. The sender name is right, the request is plausible, and the attachment is branded correctly. One detail is wrong: the payment details have changed. This is where spear phishing prevention techniques must work as an operational system, not as a checklist of email settings or an annual awareness course.
Spear phishing is designed for a particular person, team or organisation. Attackers use public information, compromised accounts, supplier relationships and previous correspondence to make messages credible. They may be seeking credentials, diverting payments, delivering malware or establishing a foothold for a wider compromise.
For UK organisations operating substantial Microsoft 365 estates, the practical question is not whether a malicious email will arrive. It is whether employees can identify and report it, whether security teams can determine its scope quickly, and whether confirmed threats can be removed before they cause harm.
Why layered spear phishing prevention matters
Email security controls stop a large volume of known threats, but targeted attacks are built to exploit the gaps. A message may come from a genuine, compromised mailbox. It may use a newly registered domain with no established reputation, contain no attachment, or direct the recipient to a legitimate cloud service hosting a malicious file.
This is why prevention cannot rest solely on a secure email gateway or Microsoft 365 configuration. Technical controls remain essential, particularly anti-spoofing, authentication, URL and attachment inspection, and conditional access. But human reporting, phishing triage and remediation complete the defence.
The most effective programmes create a feedback loop. Employees report suspicious emails through a simple Outlook mechanism. Analysts assess those reports with sufficient context and threat intelligence. Confirmed messages are remediated across affected mailboxes. The findings then improve user training, detection logic and response playbooks.
1. Make suspicious email reporting easy
Employees are often the first people to see a targeted message. That advantage is lost when reporting requires forwarding the email, raising a service ticket, or deciding which shared mailbox to use. Those steps create delay and encourage uncertain users to do nothing.
Provide a clearly labelled reporting button in Outlook and set expectations for its use. Staff should be encouraged to report messages that are unusual, not only messages they can prove are malicious. A supplier invoice that seems out of character, a colleague requesting a gift card, or a Microsoft 365 sign-in prompt with unexpected timing are all valid reports.
Reporting should not be treated as a compliance exercise. It is a source of frontline detection. The process also needs to preserve the original message and technical artefacts, rather than relying on screenshots or manually forwarded copies that may lose valuable headers and URLs.
2. Train for the decisions people actually make
Generic phishing training often focuses on obvious warning signs: poor spelling, impersonal greetings and dubious logos. Targeted phishing rarely depends on those mistakes. More useful training reflects the decisions different functions face.
Finance teams should practise identifying invoice fraud, amended bank details and urgent payment requests. HR teams need to recognise recruitment-themed credential theft and payroll diversion. Senior leaders and executive assistants should be prepared for business email compromise and impersonation. IT teams should understand how attackers imitate Microsoft 365 notifications and support requests.
Simulated phishing has a place here, but only if it is relevant and used constructively. The aim is to improve recognition and reporting behaviour, not to catch out individuals. Campaign results should identify patterns by role, department and attack type, then shape targeted follow-up. Repeatedly sending the same obvious test produces a metric, not necessarily reduced risk.
3. Verify high-risk requests outside email
A convincing email can pass visual inspection. For payment changes, confidential data requests, password resets, new beneficiary details and changes to payroll information, a separate verification process is required.
The key is independence. Replying to the email, calling the number in the signature, or using a number supplied in the message does not verify the request. Staff should use a trusted contact record, an established procurement system or a known telephone number. For material payments, a dual-approval workflow provides further protection.
This introduces some friction, and that is appropriate. Not every routine message needs an out-of-band call. The control should be proportionate to the financial value, data sensitivity and unusual nature of the request. Clear thresholds prevent staff from having to make those decisions alone.
4. Strengthen Microsoft 365 identity controls
Many spear phishing campaigns are credential-led. The attacker does not need to deliver malware if they can obtain a valid username and password, bypass weak sign-in controls and access email directly.
Multi-factor authentication is fundamental, but implementation quality matters. Phishing-resistant methods, such as FIDO2 security keys or certificate-based authentication where appropriate, offer stronger protection than methods vulnerable to prompt bombing or social engineering. Conditional access policies should consider sign-in risk, device compliance, location and application sensitivity.
Legacy authentication should be disabled unless there is a documented and monitored business exception. Privileged accounts require separate controls, including least privilege, dedicated administrator accounts and stronger authentication requirements. These measures reduce the value of stolen credentials and make suspicious account activity easier to contain.
5. Authenticate domains and tune email controls
SPF, DKIM and DMARC help reduce direct domain impersonation. DMARC enforcement, properly configured and monitored, is particularly valuable where attackers attempt to send messages appearing to come from an organisation's own domain.
However, domain authentication does not prevent lookalike domains, compromised third-party accounts or abuse of legitimate services. It should be part of a wider Microsoft 365 protection strategy that includes anti-phishing policies, mailbox auditing, external sender identification where suitable, safe handling of links and attachments, and monitored exceptions.
Overly aggressive filtering has a trade-off: it can delay legitimate supplier, patient, client or citizen communications. Security teams should use quarantine data, user reports and business feedback to tune controls rather than assuming a default policy suits every organisation.
6. Triage reports at operational speed
A reporting button without a defined triage process simply moves the bottleneck. Security teams need to establish whether a message is malicious, who received it, whether anyone interacted with it, and what action is required.
Effective phishing triage examines sender infrastructure, authentication results, message headers, URLs, attachments, delivery scope and known threat intelligence. It also considers business context. An email that appears benign in isolation may be part of an active supplier fraud attempt when viewed alongside other reports.
Prioritisation should reflect potential impact. A suspected credential harvest sent to a large distribution list, a payment diversion request received by accounts payable, and an email targeting a privileged administrator all warrant rapid investigation. Defined service levels and escalation paths help analysts make consistent decisions under pressure.
7. Remediate the whole campaign, not one inbox
Deleting a reported email from one mailbox is not sufficient if the same message reached dozens of colleagues. Once a threat is confirmed, investigate delivery across the estate and remove matching messages from affected inboxes and folders. Search criteria may include sender addresses, subject lines, URLs, attachment hashes and message characteristics.
Remediation should also address what happened after delivery. If a recipient entered credentials, revoke sessions, reset passwords where necessary, review mailbox rules and assess sign-in activity. If payment information was changed, involve finance immediately. If data may have been disclosed, bring in incident response, legal and compliance teams according to the organisation's established process.
Speed matters, but so does evidence. Preserve relevant messages, logs and investigation notes. This supports incident learning, regulatory obligations and any subsequent fraud investigation.
8. Use real attacks to improve human risk management
The strongest prevention programmes learn from the messages employees report. Trends may show that attackers are repeatedly impersonating a particular supplier, targeting a specific business unit, using QR codes, or exploiting a current business event. These insights should inform technical detections, communications and training.
Measure more than training completion. Useful indicators include reporting rates, time from report to triage, time to remediation, repeat attack themes, user interaction rates and the proportion of reported messages confirmed as malicious. A high volume of benign reports is not necessarily failure. It may show that employees are engaged, provided the triage function can handle the demand efficiently.
For organisations without a dedicated phishing response capability, managed phishing response can provide specialist analysis and remediation support while retaining clear ownership internally. The right model depends on message volume, operating hours, regulatory requirements and the maturity of the SOC or help desk.
Spear phishing defence becomes more dependable when every suspicious email has a clear route from employee report to investigation, remediation and improvement. Give people a simple way to raise concern, give analysts the context to act, and let each real attack make the next one harder to succeed.