Newtec Services · Cyber Resilience Series · Email Security 101
The most common way attackers get into an Irish business isn’t a hacked system. It’s an email your team almost didn’t question.
If you asked your team to picture a cyberattack, most would imagine a system being broken into. In practice, the far more common route in is much quieter: a message that looks exactly like it should. A payment request in your supplier’s usual format. An instruction from “the MD” that lands at exactly the right moment. A routine-looking notification with a link that leads somewhere it shouldn’t.
Phishing, business email compromise, and email-borne malware account for the majority of successful cyber breaches in Irish businesses, not because leaders don’t know the risk exists, but because the attacks themselves have gotten harder to spot. Here’s what actually stops them, in plain English.
What Is Email Security, Really?
It isn’t one setting or one tool. It’s a layered set of controls that work together: filtering what arrives, verifying who it’s really from, protecting what’s sent, and helping your people catch the small number of attempts that get through all of that anyway.
A spam filter alone was never built to catch a message with no malicious link or attachment, just a convincingly worded request from someone who looks like your MD. That’s the gap layered email security is built to close.
Why This Should Matter at Leadership Level
Business email compromise (where an attacker impersonates an executive, supplier, or trusted contact to redirect a payment or extract sensitive information) is one of the most financially damaging email-based threats an Irish business can face. Unlike ransomware, it’s often invisible until the money has already moved.
The regulatory side compounds it. Under GDPR, a phishing attack that results in unauthorised access to personal data is a notifiable breach, and the 72-hour reporting clock to the Data Protection Commission starts the moment it’s discovered. Under NIS2, in-scope organisations are expected to demonstrate active email security controls as part of their technical resilience, not simply say a spam filter exists somewhere.
What Layered Email Security Actually Does
- Filters what arrives, before it lands: Every inbound and outbound message is checked for malicious content, suspicious senders, and known threat indicators, including attachment scanning and malicious link detection, so most threats never reach a person at all.
- Verifies who a sender really is: Authentication standards (SPF, DKIM, DMARC) confirm that a message claiming to be from your domain, or a trusted supplier’s, actually is, making it far harder for an attacker to convincingly spoof someone you trust, and stopping your own domain being used against your clients.
- Protects sensitive communications: Confidential communications (legal correspondence, financial data, client records) stay accessible only to their intended recipients, in transit and at rest.
- Backs up the technology with your people: Technology reduces exposure but can’t eliminate it, so staff get practical phishing-recognition support and a fast way to report anything that looks wrong, rather than being the last line of defence by accident.
- Keeps your email data recoverable: Email data is backed up, archived, and recoverable to a point in time, covering both operational continuity and data retention obligations under GDPR and NIS2.
What a Gap Usually Looks Like
The organisations hit hardest by email-based incidents are rarely the ones with no controls at all. They’re the ones where some layers were covered and others quietly weren’t: filtering in place but DMARC never configured, authentication standards set but staff never taken through a structured phishing awareness programme, spam caught but a targeted BEC attempt sailing straight through because the tool in place was built for mass phishing, not one convincing email aimed at one person.
A filter tuned for bulk phishing campaigns won’t necessarily catch a spear-phishing email built around information about your organisation that’s publicly available. And authentication that stops your domain being spoofed does nothing to stop an attacker registering a lookalike domain instead. Layered coverage is what closes the gaps a single control leaves open.
What “Good” Looks Like
The volume of malicious email reaching your people drops sharply: mass phishing, spoofed senders, and malicious attachments are filtered upstream, not left for staff to catch. Payment requests and executive instructions are checked against authentication controls before they become a transaction. Your domain is protected too, so it can’t be used to attack your own clients and suppliers. And when the Data Protection Commission, a client, or your board asks how email risk is managed, you have a specific, documented answer, not “we have a spam filter.”
Quick Answers (Email Security 101 FAQ)
Q: Doesn’t Microsoft 365 or Google Workspace already handle this?
Built-in filters catch a meaningful share of obvious threats, but BEC attempts are specifically designed to have no malicious link or attachment for a default filter to catch. They rely entirely on convincing language and timing. That’s why authentication (DMARC/DKIM/SPF), dedicated BEC detection, and staff awareness sit on top of whatever your provider includes by default.
Q: What’s the actual difference between phishing and business email compromise?
Phishing is broad: the same malicious email sent widely, hoping someone clicks. BEC is targeted and researched: an attacker impersonates a specific person, like your MD or a known supplier, to request a specific action, usually a payment or a sensitive file.
Q: We use a spam filter already. Isn’t that enough?
A filter tuned for mass phishing campaigns is not built to catch a single, carefully worded impersonation attempt aimed at one person in your finance team. That gap is exactly what BEC-specific detection and DMARC/DKIM/SPF authentication are for.
Q: What should staff do with a suspicious email?
Report it through your organisation’s process rather than replying or acting on it, and verify any unusual payment or data request through a separate channel (a phone call, not a reply to the same email thread) before doing anything.
If you’re not sure your business has a real answer to “how is our email risk actually managed,” that’s worth finding out before an incident forces the question. Newtec helps Irish businesses put layered email security in place, covering authentication, filtering, and staff awareness together.
Talk to Newtec about your email security setup.
Sources
- NCSC Ireland: Protecting Against Business Email Compromise and Payment Fraud. Ireland’s official guidance on BEC and payment fraud, including verification steps for smaller organisations (25 July 2025).
- General Data Protection Regulation (EU) 2016/679. The official EU regulation. Article 33 sets the 72-hour breach notification duty referenced above; Article 32 covers security-of-processing obligations.
- Data Protection Commission (DPC) Ireland. Ireland’s GDPR supervisory authority, the body notified under Article 33 in the event of a qualifying breach.
- NIS2 Directive (EU) 2022/2555. The official EU directive text. Articles 20-21 cover the technical risk-management measures referenced above.
