Phishing Defense Kit: Train Your Team + Incident Response Plan
2026-10-13 · 8 min read
Most breaches don't start with a zero-day. They start with an email that looked right. Phishing remains the top initial-access vector year after year — not because filters fail, but because one convincing message only needs to fool one busy person. This kit gives your team the human layer of defense: how to recognize phishing, exactly how to report it, and an incident response plan template for when something gets through.
Step 1 — Teach the 7 red flags
Run through these with your team. Real examples beat abstract warnings — pull two or three anonymized phishing emails your company has actually received.
1. The sender domain is almost right. micorsoft-support.com, yourbank-secure.net, companny.com. Attackers register lookalike domains — this is exactly what typosquatting and lookalike-domain fraud are. Train people to read the domain character by character, not glance at the display name.
2. Manufactured urgency. "Your account will be suspended in 24 hours." "Confirm this wire transfer before 5 PM." Urgency shuts down critical thinking — that's the point.
3. Links that don't match their text. Hover (don't click) and read the real destination. A button labeled "Reset password" pointing at a random domain is the whole attack.
4. Unexpected attachments, especially Office docs and archives. Invoices you didn't order, "updated" HR policies, shipping notices for things you didn't buy.
5. Requests that break normal process. The CEO emailing finance directly to wire money, IT asking for your password, a vendor sending new bank details by email. Legitimate organizations don't do these things by email.
6. Generic greetings and tone shifts. "Dear Customer" from your bank. A colleague who normally writes casually suddenly sending stiff formal English — or vice versa.
7. Too good, too scary, or too strange to be routine. Refunds you didn't request, legal threats out of nowhere, gifts and prizes. Emotion is the payload.
Step 2 — The 10-second check ritual
Give everyone one habit for any email that asks them to click, open, pay, or share credentials. Ten seconds, three questions:
Who sent this really? Expand the sender. Read the actual domain, not the display name. On mobile, tap the name to reveal the address.
Where does the link go? Hover or long-press. If the destination domain isn't the organization's real domain, stop.
Did I expect this? If not, verify through a different channel — call the sender at a known number, open a fresh browser tab and type the site address yourself, or ask IT. Never reply to the suspicious email to "check."
Post this ritual where people see it: onboarding docs, the intranet, a sticker on the break-room wall. Habits beat annual training decks.
Step 3 — Make reporting frictionless
A phishing email nobody reports is a free reconnaissance pass for the attacker. Set up one obvious reporting path and drill it:
One button or address. A "Report phishing" button in the mail client, or a single monitored address like phishing@yourcompany.com. One path, no ambiguity.
What to include. The original message as an attachment (not forwarded inline — forwarding strips headers IT needs), plus what made them suspicious and whether they clicked anything.
What NOT to do. Don't delete it (evidence), don't forward it to colleagues as a warning (you'd be spreading the phish), don't try to "investigate" by clicking around.
Close the loop. IT confirms receipt and later tells the reporter what it was. People stop reporting into a black hole.
Step 4 — Incident response plan template
When someone clicks, minutes matter. Fill in the brackets and keep this where your IT lead can reach it at 2 AM:
Roles. Incident lead: [name]. IT responder: [name]. Communications: [name]. Executive decision-maker: [name]. Everyone knows their job before anything happens.
First 15 minutes — contain. Isolate the affected machine from the network (don't power it off — memory forensics may matter). Revoke the user's sessions and force a password reset. Check mail logs: did the phish go to others? Pull the malicious URLs/domains for blocking.
First hour — assess. What did the payload do? Credentials entered where? Any lateral movement in logs? Preserve email headers, the original message, and endpoint logs. If customer data may be involved, start the breach-notification clock per your jurisdiction's rules.
Same day — eradicate and communicate. Remove the attacker's foothold, block the sender domain and URLs at the gateway, hunt for lookalike domains targeting your brand (see our impersonation checklist). Tell affected staff plainly what happened and what to watch for — no blame, or the next incident goes unreported.
Within a week — learn. Short post-mortem: how did it get past filters, which red flag was missed, what changes (filter rule, training example, process fix). Update this plan with what you learned.
Step 5 — Run a drill
A plan nobody has rehearsed is a document, not a capability. Twice a year, run a tabletop exercise: hand the team a realistic scenario ("finance received a wire-fraud email from a lookalike of our domain at 4:45 PM on a Friday") and walk through Steps 3–4 out loud. Time it. The gaps you find in a calm room are the ones that would have hurt in a real incident.
Consider a controlled phishing simulation for training — with leadership's explicit approval, clear opt-out communication afterward, and zero punishment for clickers. The goal is measurement and teaching, not gotchas.
Step 6 — Automate the technical layer
Training handles the human side; tooling should shrink what reaches humans at all. DomainGuard watches the infrastructure attackers build on: typosquat and lookalike domain monitoring catches the micorsoft-support.com registrations before they're weaponized, BEC early warning flags impersonation attempts against your executives, and certificate-transparency monitoring spots rogue certificates on lookalike domains. The fewer convincing fakes that reach inboxes, the less your 10-second ritual has to catch.