Person checking email on laptop with a new message notification, sitting at a desk with a coffee cup, graphs, pen, smartphone, and glasses.

Email Filtering for Small Businesses: What It Actually Does, What It Misses, and What to Ask Your IT Provider

By Jason Russell · September 2, 2026

If you run the office, you already know where most of the bad days start. Not with a hacker in a hoodie, but with an email. A vendor invoice with new banking details. A DocuSign notice that leads to a login page. A message from the owner asking someone in accounting to handle something quickly and quietly. Email is still the front door to most small businesses, and email filtering is the lock on that door.

This post explains what business email filtering does in plain terms, what the current threat data says about why it matters, what you very likely already have (and are probably not using fully), and where filtering falls short no matter how much you spend on it. It ends with a short list of questions worth asking whoever manages your email, whether that is us or someone else.

What the data actually says

We try to avoid inflated statistics in these posts. Two primary sources are worth your time here: the FBI Internet Crime Complaint Center (IC3) annual report and the Verizon Data Breach Investigations Report (DBIR). Both are free, both are widely cited, and both have limitations we will point out.

In its 2025 Internet Crime Report, the FBI IC3 logged 1,008,597 complaints and $20.877 billion in reported losses, a 26 percent increase in losses over 2024. Phishing and spoofing was the single most reported crime type at 191,561 complaints. Business email compromise (BEC), where a criminal uses a compromised or impersonated email account to redirect payments, produced 24,768 complaints and $3,046,598,558 in reported losses, second only to investment fraud. That works out to roughly $123,000 per BEC complaint.

Two cautions. First, IC3 figures are self-reported and the FBI itself notes they undercount. Second, those dollar losses skew toward larger victims and real estate closings; a typical small business loss is usually smaller. What the numbers reliably tell you is direction, not your personal exposure: email-based fraud is growing, not shrinking, and it costs far more per incident than the malware categories that get more press.

The 2026 Verizon DBIR, which analyzed more than 22,000 confirmed breaches, reports that the human element was present in 62 percent of breaches, up from 60 percent the prior year. Social engineering was the third most common breach pattern at 16 percent of all breaches, and phishing held steady at 16 percent of initial access vectors. One newer finding matters for filtering specifically: in phishing simulations, the median click rate on mobile-centric vectors such as voice and text was about 40 percent higher than on email. Attackers are following people to their phones because email filtering has gotten harder to beat. That is a backhanded compliment to the technology, and it is also a warning that filtering alone is not the whole answer.

The plain-English takeaway: Email is still the most common way criminals reach your staff, and the highest-dollar email crime (BEC) usually does not involve a link or an attachment at all. Good filtering removes most of the noise and most of the obvious attacks. It does not remove the need for a human process around money.

What email filtering actually does

“Spam filter” is an outdated name for what modern business email filtering does. A current-generation filtering stack, whether built into Microsoft 365, Google Workspace, or delivered by a third-party gateway, runs a message through several independent checks before and after it lands in an inbox. Here is the sequence in rough order, with the business reason for each layer.

1. Connection and reputation filtering

Before the message content is even read, the filter looks at where it came from. Known-bad sending servers, freshly registered domains, and infrastructure with a history of abuse get rejected or scored down at the door. This layer alone removes the majority of raw junk volume and costs almost nothing in processing time.

2. Sender authentication (SPF, DKIM, DMARC)

These three DNS records answer a simple question: is this message really from the domain it claims to be from? SPF lists which servers are allowed to send for a domain. DKIM adds a cryptographic signature to each message. DMARC ties the two together and tells receiving servers what to do when they fail (monitor, quarantine, or reject). We covered these in more depth in How to Stop Someone From Sending Email in Your Company’s Name.

This matters in two directions. Inbound, your filter uses these checks to catch messages pretending to come from your bank, your payroll provider, or your own domain. Outbound, the major mailbox providers now require authentication from senders. Google’s sender guidelines require all senders to publish SPF or DKIM, and require bulk senders (5,000 or more messages per day to Gmail) to publish SPF, DKIM, and DMARC with alignment. Yahoo adopted matching requirements, and Microsoft announced equivalent rules for Outlook.com in 2025. If your domain is not set up correctly, your legitimate invoices and quotes can land in customer spam folders. We see this regularly with businesses that added a CRM or marketing tool and never updated their SPF record.

3. Content and spam scoring

The filter reads the message and assigns a score based on thousands of signals: language patterns, formatting tricks, hidden text, mismatched links, bulk-mail fingerprints, and machine-learning models trained on enormous volumes of confirmed spam and phishing. Microsoft documents this as a spam confidence level; Google uses similar internal scoring. Messages above a threshold go to quarantine or junk. The threshold is adjustable, and where you set it is a business decision, not a technical one. Set it too aggressively and legitimate mail from new customers gets lost. Set it too loosely and you are paying for a filter that mostly waves things through.

4. Attachment and malware scanning

Every attachment is checked against known malware signatures. Better filters go further and open unknown attachments in an isolated sandbox to watch what they do before delivery (Microsoft calls this Safe Attachments; other vendors use terms like detonation or sandboxing). A related and underused control is simply blocking file types your business never legitimately receives by email. Executables, script files, and disk images have no business arriving in an accounting inbox. CIS Controls version 8, Control 9, lists blocking unnecessary file types and deploying email server anti-malware as baseline safeguards for organizations of every size.

5. Link protection at time of click

Phishing links are often clean when the email arrives and turned malicious hours later, after the filter has already inspected them. Time-of-click protection rewrites every link so that when a user clicks, the destination is re-checked at that moment. Microsoft’s Safe Links documentation describes exactly this: URLs are checked against known-malicious lists when clicked, and unknown destinations are analyzed. This closes a gap that signature-based scanning cannot.

6. Impersonation and BEC detection

This is the layer most relevant to the $3 billion problem above. Impersonation protection watches for display names that match your executives or key vendors but come from outside addresses, look-alike domains (harm0nymsp.com instead of harmonymsp.com), first-contact senders, and language patterns associated with payment redirection or urgency. It is the newest and least mature layer, and it is where the difference between a basic plan and an advanced one shows up most.

7. Post-delivery removal

Sometimes a message gets through and is later identified as malicious because the same campaign hit thousands of other organizations. Modern platforms can reach back into inboxes and pull the message out after delivery. Microsoft calls this Zero-hour Auto Purge. It is quiet, automatic, and one of the more valuable features nobody notices.

8. Outbound filtering

Filtering is not only about what comes in. Outbound scanning catches a compromised mailbox in your own company that has started sending phishing to your customers, which is how many small businesses first learn they have been breached. It also prevents a single infected workstation from getting your entire domain blocklisted.

The business benefits, stated honestly

Here is what a properly configured filtering stack actually delivers for an office of ten to two hundred people.

  • Less noise, more hours. Raw spam volume is a productivity tax. Even at ten seconds per junk message, a team of thirty receiving twenty junk messages each per day loses about 25 hours a month to deleting mail. Good filtering makes that number close to zero.
  • Fewer credential phishes reaching humans. The DBIR’s 16 percent phishing figure is measured on what got through. Every credential-harvesting message the filter catches is one your least-caffeinated employee never has to judge at 4:45 on a Friday.
  • Malware stopped before the endpoint. Endpoint protection is important, but it is a second chance, not a first line. Blocking a malicious attachment at the mail server means it never touches a workstation.
  • Earlier warning on BEC. Impersonation controls will not catch every payment fraud attempt, but they flag the obvious ones and, more importantly, they generate a warning banner that reminds staff to verify.
  • Your own mail gets delivered. Correct SPF, DKIM, and DMARC are now a deliverability requirement, not just a security best practice. This is the benefit most business owners do not connect to “email filtering,” and it directly affects whether quotes and invoices reach customers.
  • Faster detection of a compromised account. Outbound filtering and quarantine reporting mean an account that starts misbehaving gets noticed in minutes, not after a customer calls to complain.
  • Evidence for insurance and compliance. Cyber insurance applications increasingly ask whether you have email filtering with link and attachment protection, and whether DMARC is enforced. Being able to answer yes with documentation affects both eligibility and premium. (See How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy.)

What you probably already have

If your business runs on Microsoft 365, every mailbox already passes through Exchange Online Protection (EOP). Microsoft’s own documentation confirms it cannot be fully turned off: spam filtering, malware scanning, and basic anti-phishing run on every plan, including Business Basic. Microsoft 365 Business Premium adds Defender for Office 365 Plan 1, which brings Safe Links, Safe Attachments, and the impersonation protection described above. Google Workspace includes comparable filtering on every tier, with advanced phishing and malware controls in the admin console.

Here is the honest part. The default settings on both platforms are deliberately conservative, because Microsoft and Google would rather deliver a borderline message than get blamed for blocking a real one. Impersonation protection for your executives is not configured until someone enters their names. Unnecessary file types are not blocked until someone builds the list. Quarantine notifications go to end users by default, which means a busy office manager becomes the security reviewer for the whole company. In our experience, the gap between “we have email filtering” and “our email filtering is doing its job” is almost entirely configuration, not licensing.

Third-party email security gateways and API-based add-ons from vendors like Proofpoint, Mimecast, Barracuda, and Abnormal exist, and some of them are very good, particularly at BEC detection. They also add cost, another vendor relationship, and another place where mail can get stuck. For most businesses under two hundred seats, our starting recommendation is to fully configure what you already pay for before adding another layer. For firms that move a lot of money by wire, handle protected health or legal data, or have been hit before, a dedicated add-on can be worth it. That is a conversation, not a default.

A note on self-interest: Harmony MSP bills for the time it takes to configure and maintain email filtering, and we sell Microsoft 365 licensing. We benefit when clients upgrade to Business Premium. We also spend far fewer unbillable hours cleaning up after a compromised mailbox when filtering is set up properly, so the incentive runs both ways. We would rather tell you that plainly than pretend the advice is purely altruistic.

Where filtering falls short

Anyone who tells you email filtering solves phishing is selling something. Here is what it does not do.

  • Text-only BEC. A message from a real, compromised vendor account, with no link and no attachment, asking you to update banking details, passes every technical check. The domain authenticates. The sender has a history with you. The filter has nothing to score. This is exactly how most large BEC losses happen, and it is why the FBI’s report describes BEC as a scam that often does not depend on malicious links or malware.
  • Mobile and voice. The DBIR’s 40 percent higher click rate on mobile-centric attacks reflects text messages and phone calls that never touch your mail filter at all.
  • Authorized third parties. Attackers now use legitimate document-sharing, e-signature, and file-transfer services to host phishing pages. The email is genuinely from that service. The filter is right to let it through.
  • False positives. Every filter blocks some legitimate mail. A new customer’s first inquiry, a bid submission from a small supplier, or a candidate’s resume can end up in quarantine. Someone has to review quarantine regularly, and that is a real operational cost that should be assigned to a person, not assumed.

The one process fix that matters most

If you take one action from this post, make it this: establish a written rule that any change to payment instructions, bank details, or vendor remittance information is verified by a phone call to a number you already had on file, never a number in the email. No exceptions for urgency, no exceptions for the owner. This rule costs nothing, takes ten minutes to write down, and would have prevented the majority of the BEC losses in the IC3 report. Filtering reduces how often your staff face that decision. The callback rule is what protects you when the filter is, correctly, silent.

Questions to ask your IT provider

You do not need to understand the technology to hold your provider accountable for it. These questions have clear yes-or-no answers, and a good provider will show you rather than tell you.

Question Why it matters
Is DMARC published for our domain, and at what policy (none, quarantine, or reject)? “None” means you are monitoring but not protecting. Reject is the goal; getting there safely takes a few weeks of review.
Are our executives and key vendors entered in impersonation protection? This feature does nothing until names and domains are configured.
Is link protection at time of click enabled for all users? Closes the gap where links go bad after delivery.
Are attachments opened in a sandbox before delivery? Catches new malware that signature scanning misses.
Which file types are blocked outright? Executables and scripts should never arrive by email in most businesses.
Who reviews quarantine, and how often? Unreviewed quarantine is where legitimate customer mail goes to die.
Is outbound mail scanned, and will we be alerted if an account starts sending spam? Often the first sign of a compromised mailbox.
Can you show me last month’s filtering report? If the answer is a shrug, the filtering is not being managed.

How Harmony MSP approaches this

Email filtering is not an add-on at Harmony MSP. Every managed client gets a documented filtering baseline as part of the standard service: authentication records reviewed and moved toward DMARC enforcement, impersonation lists populated, file type blocking configured, time-of-click link protection enabled where the license supports it, quarantine routed to a reviewed mailbox rather than left to end users, and a monthly summary of what was blocked. We also help clients write and adopt the payment verification rule described above, because the technical controls and the human process are two halves of the same defense.

We do not claim this makes anyone phish-proof. It makes the front door a great deal harder to walk through, and it gives your team a fighting chance on the messages that still get in.

If you want a second set of eyes

If you are not sure what your current filtering is actually doing, that is a reasonable thing to want to know. Harmony MSP can review your Microsoft 365 or Google Workspace configuration and show you, in plain language, what is turned on, what is not, and what it would take to close the gaps. Call us at (407) 720-6540 and we will walk through it with you. No pressure, and you will leave the conversation knowing more than you did going in.

Frequently asked questions

Do I need email filtering if I already have Microsoft 365 or Google Workspace?

You already have it. Both platforms filter every message by default and cannot be fully switched off. The question is whether it has been configured beyond the defaults: impersonation lists, blocked file types, time-of-click link protection, and quarantine review are all off or unassigned until someone sets them up.

Will email filtering stop business email compromise?

Partly. It catches impersonation attempts, look-alike domains, and messages from known-bad infrastructure. It cannot catch a plain-text request from a real vendor account that has been compromised, because that message passes every technical check. A written callback rule for any change to payment details is the control that covers that gap.

Is a third-party email security product worth the cost for a small business?

Sometimes. For most businesses under two hundred seats, fully configuring the filtering already included in Microsoft 365 or Google Workspace closes most of the gap. A dedicated add-on makes more sense for firms that move large sums by wire, handle regulated data, or have already experienced a compromise.

Why does my legitimate email keep landing in customer spam folders?

Usually because SPF, DKIM, or DMARC is missing or out of date for your domain, often after a new CRM, invoicing tool, or marketing platform was added without updating the records. Google, Yahoo, and Microsoft now require authentication from senders, so this is a deliverability problem as much as a security one.

Sources

A note on statistics: dollar figures and complaint counts above come directly from the FBI IC3 report. DBIR percentages are as published by Verizon. We have deliberately excluded secondary-source figures we could not trace to a primary report.

Our latest posts