Phishing attacks: defending your organisation

How to defend your organisation from email phishing attacks for organisational planning, review and training. NCSC guidance is advisory and should be applied to the organisation's own risks and obligations.

• Introduction
• Note:
• What is phishing?
• Why you need a multi-layered approach
• The problems with phishing simulations
• Four layers of mitigation
• Don't let your email addresses be a resource for attackers
• How do I do this?
• Reduce the information available to attackers
• Filter or block incoming phishing emails
• Carefully consider your approach to phishing training
• Make it easier for your users to recognise fraudulent requests
• Create an environment that encourages users to report phishing attempts
• Protect your devices from malware
• Protect your users from malicious websites
• Protect your accounts with effective authentication and authorisation
• Source links

• v1.016/09/2026