Phishing remains the starting point for the majority of serious security incidents, including ransomware attacks and business email compromise fraud, because it bypasses technical perimeter controls by targeting people rather than systems. This guide covers what Microsoft Defender for Office 365 actually provides, where its limits lie, and why staff awareness training is not a nice-to-have addition to technical filtering but an essential layer in its own right.
Why Phishing Is So Persistently Effective
A phishing email that successfully tricks a recipient into clicking a link or opening an attachment does not need to exploit any technical vulnerability in the recipient's systems. It exploits a human being's tendency to respond to urgency, authority, and familiar-looking communications without scrutinising them carefully. This is not a gap that will be patched in the next software update, because it is a characteristic of how people process information under the conditions of a normal working day rather than a flaw in any particular system.
Attackers are well aware of this, which is why phishing attempts grow more convincing over time rather than less. A generic mass-sent phishing email with obvious spelling errors is easy to dismiss. A carefully researched spear phishing email that references a real recent project, uses the correct email signature format for the apparent sender, and contains a plausible pretext for the requested action is meaningfully harder to detect, and is specifically designed to pass through both technical filters and recipient suspicion simultaneously.
What Microsoft Defender for Office 365 Actually Does
Microsoft Defender for Office 365 operates at several layers of the email processing chain. It scans inbound messages for known phishing indicators, suspicious sender patterns, and malicious attachments before they reach a user's inbox, quarantining or flagging messages that match threat signatures. Safe Links rewrites URLs within emails so they are checked at the moment a user clicks rather than only at delivery, catching threats where a legitimate-looking link was only weaponised after the original email passed through initial filtering. Safe Attachments detonates suspicious attachments in a sandbox environment before delivering them, detecting malware that would only activate on opening.
Together, these controls address the majority of commodity phishing at scale. Where they have genuine limitations is with targeted, novel attacks that are specifically crafted to evade signature-based detection, which is precisely the category of attack used in business email compromise and sophisticated spear phishing campaigns against specific organisations.
Why Technical Filtering Is Not Enough on Its Own
The logic of relying solely on technical filtering goes: if we stop the bad emails reaching people, people do not need to make any judgement about whether an email is safe. This logic fails at exactly the point it is tested most severely. A sophisticated targeted attack is designed around what technical filters will and will not catch. An attacker researching a specific organisation will test their phishing emails against common filters before sending them.
The gap is filled by staff who understand what phishing looks like well enough to be sceptical of something unusual even when it arrives in their inbox looking legitimate. This scepticism cannot be installed through a single training session and forgotten. It requires regular reinforcement, and phishing simulation, sending realistic but harmless test phishing emails to staff and tracking how many click, is the most effective way to build and measure that scepticism over time.
Running an Effective Phishing Simulation Programme
A well-run phishing simulation programme does several things that a passive training course cannot. It creates a real experience of being targeted, which is far more memorable than a video about what phishing looks like. It identifies which individuals and departments show higher susceptibility, allowing targeted additional training rather than generic organisation-wide sessions that do not distinguish between those who need it most and those already well-prepared. And it provides a measurable metric, click-through rate on simulated phishing over time, that actually reflects how an organisation's real-world phishing resistance is changing.
Microsoft Attack Simulator, available within Defender for Office 365, provides this capability natively within the Microsoft 365 environment, without requiring a separate third-party tool.
What This Looks Like in Practice
A business running quarterly phishing simulations tracked click-through rate by department and discovered that its finance team showed significantly higher susceptibility than other departments, specifically to simulations involving payment or invoice themes. Targeted awareness training for that team reduced the click-through rate on subsequent simulations, and the business also implemented a payment verification policy requiring a phone call to confirm any new or changed supplier bank details, regardless of how convincing the email request appeared.
Getting Started on Phishing Protection
For businesses with Microsoft 365, the starting point is confirming that Defender for Office 365 is properly configured, since default settings leave meaningful gaps that a more considered configuration closes. From there, establishing a phishing simulation programme alongside technical controls builds the human layer that technical filtering alone cannot provide.
The Advantage Transformation Sprint is a free, no-obligation session that reviews current Microsoft 365 security configuration and identifies the highest-priority gaps in phishing protection for your specific environment.
Strengthen Phishing Defence with Advantage
Advantage configures Microsoft Defender for Office 365 and runs phishing simulation and awareness programmes for UK SMEs, combining technical filtering with the human layer that technically sophisticated attacks specifically target. If you want to go beyond default filtering, speak to our team.
Contact Advantage today or call 020 3004 4600.
Read more about our Cyber Security services or explore Microsoft 365.
Related Resources
Glossary: Phishing
Ransomware Protection for SMEs
Email Security and DLP in Microsoft 365
Glossary: Multi-Factor Authentication
Glossary: Cyber Essentials Certification
