Email Security for Perth Businesses

Why email is the front door attackers knock on first in Perth

For a Perth business running 5 to 50 staff on Microsoft 365, email is where the trouble starts. Almost every breach we see locally begins with a single message that looked normal: a fake invoice from a supplier you actually use, a OneDrive share request that mimics your branding, or a "the boss needs this paid today" note timed for a Friday afternoon when the office is winding down. WA businesses are squarely in scope. Attackers buy lists of Australian company domains, scrape names and titles off your website and LinkedIn, and send convincing messages that reference your real projects and people.

The pattern that hits hardest here is business email compromise. A trades company in O'Connor, a wholesaler in Welshpool, an engineering firm in Osborne Park, the script is the same. Someone gets a credential phished, the attacker sits quietly in the mailbox reading conversations for a fortnight, then waits for a genuine invoice and swaps the bank details before forwarding it on. By the time the supplier chases payment, the money has cleared offshore. No malware, no alarm, just a quiet mailbox rule deleting the evidence.

What actually goes wrong, and what it costs a small Perth team

The damage rarely shows up as a dramatic ransomware screen. It is slower and more expensive than that. When one mailbox is compromised, the attacker uses it to phish your customers and suppliers from a trusted address, so your name is now the one sending malicious mail across Perth. We have seen owners spend a week phoning every contact to explain, watching deals stall because clients no longer trust attachments from them.

The mechanics are almost always the same handful of gaps:

• Multi-factor authentication was never enforced, so a phished password is enough to get in.
• The mailbox had no alerting, so a hidden inbox rule forwarded and deleted messages for weeks unnoticed.
• The domain had no SPF, DKIM or DMARC records set correctly, so anyone could spoof the company name and land in customer inboxes.
• Old staff accounts were still active, and a former contractor's login became the way in.

For a 5 to 50 person business the real cost is operational. The owner stops running the company and spends days on the phone to the bank, insurer and customers. Payroll or supplier runs get frozen while you confirm which instructions were genuine. Quotes and tenders go quiet because partners are nervous. That lost momentum, in a tight Perth market where reputation travels fast, hurts longer than the initial incident.

How COREWEST locks email down, Microsoft-first

You are already paying for Microsoft 365, so we secure email using the tools inside it rather than bolting on extra products you have to manage. We start by turning on what most businesses leave switched off, then tune it to your actual workflow.

• Defender for Office 365 scans inbound mail, detonates suspicious attachments in a sandbox before they reach a mailbox, and rewrites links so a click is checked again at the moment it happens, not just when the message arrived.
• Entra ID with Conditional Access enforces multi-factor authentication and blocks sign-ins that do not fit your normal pattern, so a login attempt from an unfamiliar location or an unmanaged device is stopped before a phished password becomes access.
• Microsoft Defender on the endpoints means that if a malicious attachment does get opened, the device itself catches and isolates it.
• Purview gives us audit and message tracing, so when something looks off we can see exactly what an account did, when, and from where, and prove whether a message was tampered with.
• Intune ensures mailboxes are only reachable from devices we manage and can wipe, so a lost phone or a departed staff member does not leave a door open.
• Microsoft 365 Backup keeps recoverable copies of mailboxes so a malicious deletion or a compromised account does not mean lost history.

We also fix the plumbing that lets your name be spoofed in the first place: SPF, DKIM and DMARC configured properly on your domain so other mail servers can tell a real message from your business apart from a forgery.

What is included and what good looks like week to week

Email security is not a one-time switch. Once the controls are in place, we watch them. Defender alerts and risky sign-ins come to our Perth team, not to an inbox you are too busy to check. When a staff member's account shows a suspicious login or a new forwarding rule appears, we act on it the same day, lock the account, confirm with you, and check what was touched before it spreads.

Week to week, "good" looks like this: multi-factor authentication is on for everyone with no awkward exceptions; staff who leave lose access the day they go; suspicious messages are quarantined and reviewed rather than landing in your team's inbox to gamble on; your domain passes DMARC so impersonators bounce; and you get a plain-English picture of what was blocked and why, without jargon. The goal is that a phishing email becomes a non-event your team barely notices, instead of the start of a bad week.

If you are not sure where your email stands today, the fastest way to find out is a Free Cyber Risk Snapshot. We will look at your real Microsoft 365 setup, show you exactly which of these gaps are open right now, and tell you straight what is worth fixing first. You can book it here: https://calendly.com/corewest/30min