In an increasingly interconnected world, the reliance on digital communication has grown,
and with it, the threat posed by cybercriminals. Phishing and social engineering have emerged as two of the most effective tactics used to exploit both individuals and businesses. These scams come in various forms, from the well-known phishing emails to more sophisticated attacks such as vishing and quishing.

The prevalence of these scams can be attributed to their ability to prey on human psychology, manipulating emotions like fear, urgency, and trust. By recognising these tactics and understanding how they operate, you can better protect yourself and your business from falling victim to their traps. In this article, we will explore the most common phishing and social engineering methods, explain how they work, and offer practical steps to stay safe.

What is Phishing?

Phishing is a type of cyberattack that relies on deceptive emails, messages, or websites to steal sensitive information such as passwords, financial details, or even personal identity information. Despite years of warnings, phishing remains highly effective because scammers are constantly improving their techniques to make their communications look legitimate.

The fundamental goal of phishing is to trick the recipient into believing the communication is from a trusted source. These attacks can be highly convincing, often imitating well-known brands, financial institutions, or even government agencies. Below are some of the most common types of phishing attacks.

Types of Phishing

Email Phishing
One of the most widespread forms of phishing, email phishing involves sending fraudulent emails to a large number of people, hoping that at least a few will take the bait. These emails typically impersonate trusted organisations like banks or online services and contain messages designed to prompt action.

Example: You receive an email claiming that your Amazon account has been suspended due to suspicious activity. The email provides a link where you can “verify your account.” The link takes you to a fraudulent website that looks exactly like Amazon’s login page. If you enter your credentials, they are immediately stolen.

Signs of Email Phishing:

• Generic greetings like “Dear Customer” instead of addressing you by name.
• Urgent language pressuring you to act quickly (e.g. “Your account will be suspended unless you respond immediately”).
• Suspicious attachments or links.

Spear Phishing
Spear phishing is a more targeted form of phishing, where the attacker personalises the email to a specific individual or organisation. These emails are usually crafted with great attention to detail, often including the target’s name, position, or other personal information, making them much harder to detect.

Example: A senior accountant at a company receives an email that appears to be from their CFO, asking for an urgent wire transfer. The email uses familiar language and refers to an ongoing project to make the request seem authentic.

How to Spot Spear Phishing:

• Double-check the sender’s email address. Fraudulent emails often use a slight variation of a legitimate address.
• Look for requests that seem unusual or out of character, even if they appear to come from someone you know.
• If you’re unsure, always verify the request by contacting the person directly via phone or in person.

Clone Phishing
In this variation, the attacker creates an almost identical copy of a legitimate email that you have previously received. The attacker clones the original message but replaces the attachments or links with malicious ones.

Example: You received a legitimate email last week with an invoice from a supplier. Today, you get what seems like the same email, but the attachment has been replaced with malware. Because the email looks identical to the previous one, you may be tempted to open it without thinking twice.

How to Recognise Clone Phishing:

• Look for small differences in the email’s language or layout, as attackers often miss minor details when cloning.
• Always be cautious with attachments and links, especially if you weren’t expecting them.
• Use a trusted antivirus program that scans attachments before you open them.

Whaling
Whaling is a highly targeted form of spear phishing, typically aimed at high-profile individuals within an organisation, such as CEOs or CFOs. These attacks are designed to steal sensitive corporate information or authorise fraudulent financial transactions.

Example: A CEO receives an email that appears to be from the company’s legal department, requesting confidential financial details in relation to a lawsuit. The email is crafted to be convincing, using legal jargon and mimicking the company’s internal communication style.

Defending Against Whaling:

• Implement multi-factor authentication (MFA) to add an extra layer of security for high-level executives.
• Train senior staff to recognise phishing tactics and encourage them to question unexpected requests for sensitive information.
• Ensure that high-value financial transactions require multiple levels of approval.

What is Social Engineering?

While phishing often relies on digital communication, social engineering encompasses a broader range of tactics, many of which involve direct interaction with the target. The aim of social engineering is to manipulate individuals into revealing confidential information or performing actions that compromise their security. The success of social engineering lies in exploiting human emotions, such as trust, fear, and curiosity.

Common Social Engineering Techniques

Pretexting
Pretexting is a form of social engineering where the attacker fabricates a scenario to obtain sensitive information from the target. The scammer will often impersonate someone the victim knows or trusts, such as a co-worker, IT support, or a government official.

Example: An attacker calls an employee, pretending to be from the company’s HR department, and asks for personal details to “verify” their records. The employee, trusting the authority of HR, complies, unaware that they’re speaking to a scammer.

How to Spot Pretexting:

• Be cautious when someone asks for personal or sensitive information over the phone or via email, even if they claim to be from a trusted source.
• Verify the person’s identity by contacting them through official channels, such as a company phone directory.

Baiting
Baiting is a technique where the attacker offers something enticing to lure the victim into compromising their security. This can come in the form of free downloads, media files, or even physical devices left in public places.

Example: A USB drive labelled “Confidential: Company Financials” is left on a table in your office lobby. Out of curiosity, an employee plugs it into their computer to see what’s inside, unknowingly introducing malware into the company’s network.

Preventing Baiting Attacks:

• Educate employees about the dangers of using unknown USB drives or downloading unsolicited files.
• Install security software that can detect and block malware from external
  devices.

Quishing (QR Code Phishing)
Quishing is a newer form of phishing that involves the use of malicious QR codes. Scammers may distribute these QR codes via emails, posters, or other forms of media, encouraging victims to scan them with their phones. Once scanned, the victim is taken to a fraudulent website designed to steal personal information or install malware.

Example: You receive a flyer advertising a “free meal” at a popular restaurant if you scan the QR code to download the voucher. When you scan it, you are taken to a fake website that asks for your credit card information to claim the offer.

How to Defend Against Quishing:

• Be cautious when scanning QR codes from unknown sources or unsolicited messages.
• Use a mobile security app that can scan and verify QR code links before you visit them.

Vishing (Voice Phishing)
Vishing, or voice phishing, involves attackers making phone calls to their victims, posing as legitimate institutions like banks, government agencies, or tech support. They typically use scare tactics to convince the victim to share sensitive information over the phone.

Example: A scammer calls, claiming to be from your bank’s fraud department. They inform you of “suspicious activity” on your account and request that you confirm your account details and security PIN. In reality, they are gathering the information to steal your identity.

Signs of a Vishing Attack:

• Callers pressuring you for immediate action or using scare tactics.
• Requests for sensitive information like passwords, account numbers, or PINs.
• Caller ID spoofing to make it appear as though the call is coming from a
• legitimate organisation.

Smishing (SMS Phishing)
Smishing uses text messages as a vector to deliver phishing attacks. These messages often claim to be from trusted sources like banks, government bodies, or delivery services, urging the recipient to click on a link or provide information.

Example: You receive a text message stating that a parcel could not be delivered and that you need to click a link to reschedule the delivery. The link takes you to a fake website designed to steal your personal and financial information.

How to Avoid Smishing:

• Be wary of unsolicited text messages, especially those containing links or requests for sensitive information.
• Always navigate to official websites by typing the address into your browser, rather than clicking on links in text messages.

How to Recognise a Scam: Key Red Flags

Phishing and social engineering attacks are increasingly sophisticated, but there are still
some common signs that can help you spot them:

1. Unfamiliar Senders: If you receive an email, text message, or phone call from someone you don’t recognise, especially if they are asking for sensitive information, take a step back and evaluate the situation. Scammers often impersonate people you trust, so verify their identity before acting.
2. Suspicious Links: Hover over links in emails or messages before clicking them. This will reveal the actual URL you’re being directed to, which may be different from the displayed link. If the URL looks suspicious, don’t click it.
3. Spelling and Grammar Mistakes: Many phishing emails and messages are poorly written, with noticeable spelling and grammar errors. While some attackers have improved their writing skills, it’s still common to spot these mistakes as a sign of a scam.
4. Unusual Requests: Be cautious of emails, messages, or phone calls requesting urgent action, especially if they ask for personal or financial information. Always verify the request with the supposed sender through official channels.

Protecting Yourself and Your Business

While phishing and social engineering attacks continue to evolve, there are several proactive
steps you can take to protect yourself and your organisation:

1. Employee Training: Regularly train your employees on the latest phishing and social engineering tactics. Ensure they understand the importance of vigilance and encourage them to report suspicious activity.
2. Use Multi-Factor Authentication (MFA): MFA adds an extra layer of security, requiring users to provide two or more forms of authentication to access sensitive accounts. This can help prevent attackers from accessing accounts, even if they’ve stolen a password.
3. Regular Software Updates: Ensure that all systems and software are up to date with the latest security patches. Many phishing attacks exploit vulnerabilities in outdated software.
4. Incident Response Plan: Develop a robust incident response plan that outlines the steps to take if a phishing or social engineering attack occurs. This will help minimise damage and recover quickly from any breaches.
5. Email Filtering and Firewalls: Use advanced email filtering tools to block phishing emails before they reach your inbox.

Conclusion

Phishing and social engineering attacks continue to be among the most effective cybercriminal tactics because they exploit the most vulnerable part of any security system—human psychology. By recognising the signs of these scams and implementing proactive security measures, you can significantly reduce the risk of falling victim to these attacks.

As cyber threats continue to evolve, awareness and education are critical. The more you know about phishing and social engineering tactics, the better equipped you’ll be to spot the scam before it’s too late. Empower your team, stay vigilant, and take action to protect both your personal and business information from cybercriminals.

Photos by Bernd 📷 Dittrich Zanyar Ibrahim ThisisEngineering Todd Cravens  stephen momot on Unsplash

In today’s digital age, SMEs (small and medium-sized enterprises) face many of the same cybersecurity challenges as larger companies but often lack the resources to address them effectively. Building a robust cybersecurity culture is one of the most effective ways SMEs can safeguard their operations from cyber threats. This culture extends beyond simply having policies in place; it’s about embedding security into the very DNA of your organisation so that every employee, from top leadership to entry-level staff, understands their role in keeping the company secure.

A strong cybersecurity culture helps SMEs become more resilient in the face of evolving cyber threats. When all employees are committed to security best practices, it reduces the chance of falling victim to increasingly sophisticated attacks. It’s not just about securing devices and networks; a robust culture of security is about proactive vigilance, ongoing education, and creating an atmosphere where employees feel empowered to identify and report potential issues.

In this blog post, we’ll explore the steps needed to foster a cybersecurity culture within your SME, including ongoing training, leadership involvement, and creating a response plan. These measures will help ensure your business is more resilient to cyber threats.

Why Cybersecurity Culture Matters for SMEs

Creating a cybersecurity culture isn’t just about protecting sensitive data or meeting regulatory requirements; it’s about ensuring the longevity of your business. The reality is that SMEs are frequently targeted by cybercriminals because they often have fewer resources to defend themselves. According to the UK Government’s Cyber Security Breaches Survey 2024, 48% of SMEs reported experiencing a cybersecurity breach in the past 12 months, with the average cost of a breach totalling thousands of pounds. In addition to financial losses, these attacks can severely damage an SME’s reputation and disrupt business operations.

Given the increasing digitisation of business processes, SMEs cannot afford to ignore cybersecurity. The misconception that only large enterprises are targeted by cybercriminals is no longer valid. Many SMEs hold sensitive data that can be valuable to attackers, including customer information, financial data, and intellectual property. Cybercriminals often see smaller companies as easy targets because they are assumed to have weaker defences.

Moreover, cybersecurity threats are constantly evolving. What worked in terms of defence a year ago may no longer be effective today. From phishing scams to ransomware attacks, cybercriminals continuously adapt their tactics to exploit vulnerabilities in an organisation’s infrastructure. This means SMEs must build a culture where cybersecurity awareness is ingrained in every employee’s mindset, ensuring the entire workforce remains vigilant and proactive about new and emerging threats.

Building the Foundation: Leadership Involvement

The first step in fostering a cybersecurity culture is ensuring that leadership is fully engaged in the process. Leadership sets the tone for the rest of the organisation, and without their buy-in, it will be difficult to get employees to take cybersecurity seriously. In fact, the commitment of senior management is often the deciding factor in whether a cybersecurity initiative is successful.

1. Lead by Example

Leaders must demonstrate a commitment to cybersecurity by participating in training and adhering to the same security policies as everyone else. When employees see management taking security seriously, they are more likely to follow suit. Moreover, when leaders show that they, too, are subject to the same protocols and scrutiny, it reduces the perception of cybersecurity being a burdensome requirement imposed solely on lower-level employees.

For leadership, it’s essential to highlight how cybersecurity contributes to the company’s overall mission. For example, protecting sensitive customer data could be framed not only as a compliance obligation but also as a way to build trust and loyalty with customers. Additionally, security measures help protect the company from financial losses and reputational damage, which are critical to the business’s long-term sustainability. Leaders who emphasise this alignment between cybersecurity and business goals help reinforce its importance across the organisation.

2. Appoint a Cybersecurity Champion

If your SME doesn’t have the resources to hire a full-time Chief Information Security Officer (CISO), consider appointing a cybersecurity champion from within your organisation. This person will act as the point of contact for all security-related concerns, drive security initiatives, and help promote a culture of awareness. They can ensure that security is consistently discussed at meetings, initiate training opportunities, and spearhead efforts to improve company-wide adherence to cybersecurity protocols.

While your cybersecurity champion may not necessarily have deep technical expertise, their role is more about coordination and communication. They serve as the go-to person for employees with questions or concerns about cybersecurity and help reinforce security best practices in everyday business activities. Having someone in this role makes cybersecurity feel more accessible and reinforces the idea that everyone has a stake in the company’s security posture.

Employee Engagement: Ongoing Training and Education

One-off training sessions or annual security updates are no longer enough to keep employees aware of the latest threats. Cyber threats are constantly evolving, and so must your training initiatives. Ongoing education and engagement are essential to maintaining a cybersecurity culture. Regular training helps to address common human errors, such as falling for phishing scams or using weak passwords, which are frequently exploited by cybercriminals.

1. Tailor Your Training

The most effective training programmes are tailored to your specific industry and company structure. While generic training can raise awareness, training that is relevant to the threats your organisation faces will be more impactful. For example, if your SME handles sensitive financial information, training should focus on the types of cyber threats targeting the finance sector, such as phishing, social engineering, or ransomware. Tailoring the content makes the training more engaging and relevant, increasing the likelihood that employees will take it seriously.

It’s also important to take into account the varying levels of technical expertise within your team. While some employees may be well-versed in technology and security practices, others may not. Adjust your training accordingly, offering different levels of instruction to ensure that even those who aren’t tech-savvy can understand the risks and their role in maintaining security.

2. Make Training Interactive

Training doesn’t have to be boring. Interactive sessions, quizzes, and real-world simulations, such as phishing simulations, can help employees understand the risks and consequences of cybersecurity lapses in an engaging way. Many companies now offer gamified cybersecurity training, which makes learning about security fun and competitive. This approach increases retention of key lessons, as employees are more likely to remember scenarios they’ve actively participated in.

Phishing simulations are especially important, as phishing remains one of the most common and effective tactics used by cybercriminals. Sending mock phishing emails to employees and monitoring their responses allows you to identify weaknesses and provide additional training to those who need it. When employees are tested regularly, they are more likely to remain vigilant and sceptical of suspicious emails, reducing the risk of a successful attack.

3. Establish a Regular Training Schedule

Cybersecurity should be an ongoing conversation within your organisation. Consider holding quarterly or even monthly security training sessions to keep employees updated on the latest threats and best practices. Regularly review your training materials to ensure they address current threats and compliance requirements. Employees should also be reminded of the consequences of failing to adhere to security protocols, such as disciplinary action or the potential for a data breach

that could damage the business’s finances and reputation.

Training should be accessible, easy to understand, and practical. As threats evolve, new training content should reflect these changes. For example, emerging threats like quishing (QR code phishing) or supply chain attacks should be discussed in upcoming sessions. Make sure employees know that cybersecurity training isn’t a one-time event but a continual process aimed at keeping the business secure in an ever-changing digital landscape.

Foster an Open Reporting Culture

One of the biggest barriers to creating a cybersecurity culture is the fear employees may have of reporting mistakes. Whether it’s accidentally clicking on a phishing link or mishandling sensitive information, employees may hesitate to report incidents for fear of punishment or embarrassment. Unfortunately, this reluctance can allow small issues to spiral into major security breaches, which could have been mitigated with timely reporting.

1. Remove the Stigma Around Cybersecurity Incidents

To foster a cybersecurity culture, create a non-punitive reporting process. Emphasise that mistakes happen, and that the most important thing is to report incidents quickly so they can be addressed. This approach not only reduces the likelihood of an unreported breach but also encourages employees to be proactive in spotting and reporting potential vulnerabilities.

Create an environment where employees feel safe and supported when discussing cybersecurity. Consider adding anonymous reporting mechanisms, so employees can report incidents without fear of personal repercussions. By focusing on correcting mistakes rather than assigning blame, your SME can address risks proactively and reduce the likelihood of small errors snowballing into major security incidents.

2. Implement a Clear Reporting Process

Ensure that employees know exactly how to report security incidents, and make the process as simple as possible. Whether it’s a dedicated email address, an internal ticketing system, or a phone line, having a streamlined process ensures incidents are reported and addressed quickly. Encourage employees to report even minor concerns—what may seem insignificant to them could indicate a larger issue.

You should also ensure that employees are comfortable asking questions when they are unsure about the legitimacy of an email, link, or attachment. Having an accessible support structure where employees can confirm whether something is suspicious is vital for preventing security breaches. Remind employees that reporting suspicious activity, even if it turns out to be harmless, is far better than ignoring it altogether.

Incorporate Cybersecurity into Day-to-Day Operations

For cybersecurity to become part of your company’s culture, it must be incorporated into everyday activities. This doesn’t mean bogging employees down with complex security tasks, but rather making security a natural part of their workflow. When security becomes a habit rather than a burden, it becomes ingrained in the daily routine of your employees.

1. Automate Where Possible

Cybersecurity can be overwhelming, especially for employees who aren’t tech-savvy. To help integrate security into daily tasks, consider using tools that automate some of the more complicated aspects of cybersecurity. For example, password managers can help employees create and store strong, unique passwords without having to remember them, and multi-factor authentication (MFA) can add an extra layer of security without requiring much effort from the user.

In addition to password management and MFA, consider using automated tools that regularly scan your systems for vulnerabilities, ensuring that any weaknesses are identified and addressed before they can be exploited. Automated patch management systems, which update software as soon as security patches become available, can significantly reduce the risk of attacks that exploit outdated software. By automating key processes, you remove the burden from employees and reduce the risk of human error.

2. Security as a Conversation Topic

Security should be a regular agenda item in team meetings. Brief employees on new security initiatives, emerging threats, or any incidents that occurred in the wider industry. This not only keeps security top of mind but also helps normalise it as a critical business function. Discussing cybersecurity as part of normal business operations helps embed it into your company’s everyday processes.

Having a dedicated time for discussing security can also bring attention to industry-specific threats. If an SME operates in sectors like healthcare, finance, or e-commerce, the risks associated with breaches can be particularly high. Incorporating discussions around cybersecurity in day-to-day meetings ensures that employees remain aware of these risks and can act accordingly.

Develop a Comprehensive Incident Response Plan

No matter how strong your cybersecurity culture is, incidents will happen. The key is being prepared. A well-developed incident response plan is essential for quickly and effectively managing a breach. It provides clear guidance for the team, outlining the actions they need to take when a security incident occurs, which helps minimise damage.

1. Identify Your Critical Assets

Your incident response plan should begin by identifying the assets that are most critical to your business. These could include customer data, intellectual property, or operational systems. Once identified, you can create a priority list to help your team focus on what needs to be protected first in the event of a breach. Understanding your most valuable assets will enable you to tailor your incident response plan and ensure that the most critical parts of your business are protected.

In SMEs, critical assets can vary greatly depending on the industry. For instance, in a financial services SME, customer data and transactional systems will be key priorities. In contrast, for a retail SME, customer credit card data and e-commerce platforms may be the primary concern. Once these assets are identified, you can categorise the risks and assign appropriate security measures, ensuring that these high-priority elements are adequately safeguarded.

2. Outline Key Roles and Responsibilities

A clear incident response plan should assign specific roles to team members. Everyone should know who is responsible for what during a cybersecurity incident. This includes not only IT staff but also communication teams, HR, and leadership. Employees should also know whom to report to in the event of a breach.

The incident response team should be equipped with a plan that is tailored to the type of attack being experienced. For example, a ransomware attack may require different actions from a data breach. Key personnel should be trained on how to handle different scenarios, ensuring that the response is swift and effective. Additionally, outlining roles and responsibilities ahead of time ensures that there is no confusion during an actual event, and the team can act quickly to mitigate damage.

3. Create a Communication Plan

A communication plan is a critical part of incident response. This includes internal communication (informing employees about the breach and how it’s being handled) as well as external communication (notifying clients, partners, and regulators). Make sure your communication plan is clear, concise, and ready to be implemented at a moment’s notice. Be transparent about what is happening and provide reassurance that the incident is being managed.

Clear communication is also essential for maintaining customer trust. In the event of a breach, you must inform affected customers quickly and provide them with guidance on any actions they should take, such as changing passwords or monitoring accounts for suspicious activity. Transparency helps manage reputational risk and can help preserve client relationships even in the face of a cybersecurity incident.

4. Conduct Regular Drills

Incident response plans should be tested regularly. Conduct drills or simulations to ensure that all employees know their roles and can respond effectively. These drills should mimic real-life scenarios, such as a ransomware attack or a data breach, to help employees get used to the pressure of responding to an actual incident.

Regular drills allow you to identify weaknesses in your incident response plan, enabling you to make improvements before a real breach occurs. Simulations also give employees a better understanding of how incidents unfold, the decisions they may need to make, and how quickly they need to act to minimise damage. The more comfortable employees are with the process, the more efficiently they will respond during an actual incident.

Encourage Personal Cybersecurity Responsibility

While businesses can put countless policies, tools, and procedures in place, ultimately, it’s up to each individual employee to take responsibility for their own cybersecurity. Encouraging this personal responsibility is the final step in creating a cybersecurity culture. When employees understand that they play a crucial role in protecting company assets, they are more likely to stay vigilant and adopt good cybersecurity practices.

1. Promote Safe Personal Habits

Encourage employees to adopt good cybersecurity habits not just in the workplace but in their personal lives as well. This could include using strong, unique passwords for personal accounts, enabling MFA on social media accounts, or being mindful of the risks associated with sharing too much personal information online. When employees apply these practices in their personal lives, they are more likely to bring the same level of vigilance to the workplace.

Educating employees about the overlap between personal and work cybersecurity is essential. With remote and hybrid working environments, the lines between personal and professional devices and networks can blur. Ensuring that employees understand how their personal digital habits can affect the security of business data is key. Whether they are using their own devices for work or sharing company information across personal networks, they must adopt best practices in every aspect of their digital lives.

2. Reward Good Cybersecurity Behaviour

Incentivising good cybersecurity practices can further encourage a security-conscious culture. Whether it’s through a formal reward system or informal recognition, acknowledging employees who consistently demonstrate good security behaviour reinforces the importance of cybersecurity.

Reward systems can be simple yet effective. For example, recognising an employee who successfully identifies and reports a phishing attempt can encourage others to stay alert. Alternatively, offering small incentives for employees who complete cybersecurity training modules or contribute to the company’s security initiatives can also boost participation and engagement. By rewarding positive behaviours, you create an environment where employees feel motivated to contribute to the company’s security efforts.

Conclusion

Creating a cybersecurity culture in your SME is an ongoing process that requires commitment from all levels of the organisation. By involving leadership, providing ongoing training, fostering an open reporting culture, integrating security into daily operations, developing an incident response plan, and encouraging personal responsibility, you can build a culture where cybersecurity is a top priority.

In a world where cyber threats are constantly evolving, having a cybersecurity culture isn’t just a nice-to-have; it’s a business necessity. A well-trained, security-conscious workforce is your first line of defence against cybercriminals, helping to protect your SME from costly and potentially devastating cyberattacks. By embedding security into your company’s values and day-to-day operations, you’ll be well on your way to creating a more resilient and secure organisation.

We are here to help you as we appreciate there is a lot to think about! May we recommend your first step? Book a call and a demo so we can show you SOS Intelligence – we promise it will help you sleep easier at night.

Photos by John Schnobrich, Luca Bravo, Riccardo Annandale Dylan Gillis Alvaro Reyes Ariel