Statistics say that over 90% of all cybersecurity breaches are because of human error.  People will always be the top reason why breaches occur.  From losing a laptop, sending an incorrect file, or clicking on an email and giving away their credentials, people unfortunately do not always make the right decisions.

This year the number of phishing emails have exponentially increased.  More barriers have been put in place to catch these emails before they can get into a person’s inbox, but the phishers are getting smarter.  They are changing what they are sending and are successfully being delivered into the inboxes of your staff.  The best way to decrease your risk is to provide education.

Focus on the following:

1. Teach your staff to always be skeptical.  If it looks phishy, it probably is phishy.
2. Always check who the sender is.  It may have the name of your CEO as the sender, but look at the email address. If it says, CEO Name <yourceo@gmail.com>, then you may want to take a closer look.  If your CEO never communicates with that Gmail address, then you need to suspect this may be phishing.
3. If there are links in the email that is asking you to log in, but the site is not the typical site you would go to.  You receive a email from Microsoft 365 asking you to enter in your credential but you look at the link and it goes to https://myofficelogin.com. This is not a legitimate Microsoft domain so you should be careful.
4. Often phishing emails will have an urgent tone to have the user take action immediately in the hopes they will get you to do something without follow up, or even thinking twice.  
5. If there are links in the body of the email that are going to different domains that do not correspond to the subject matter of the email, then it may be phishing

Non-technical users can be just as effective avoiding phishing by being educated on what to look for.  Make sure they know what to do if they come across anything that they may be skeptical of.  Remember, always be grateful when a user comes to you with a suspected phishing email.  You will never lose data if the person is wrong, it is just another great teaching opportunity.  You will be more likely to lose data if they are too worried about how you will react to their suspected phishing email and don’t come to you.