Phishing in Everyday Business: Turning Employees into a Human Firewall

Spam filters, firewalls, and anti-virus catch most attacks – but not all of them. Sooner or later a well-crafted phishing email lands in an inbox: an invoice from a familiar supplier, a sharing request from Microsoft 365, an urgent request from management. Whether it turns into an incident is then decided by the person in front of the screen.

The good news: this behavior can be trained. A "human firewall" isn't built by one mandatory session a year, but by three building blocks working together: regular awareness training, realistic phishing simulations, and clear rules for emergencies. This guide shows how to set up all three in your company.

Why technology alone isn't enough

Attackers deliberately optimize their emails to bypass filters: new sender domains, links to legitimate cloud services, QR codes instead of links, text without spelling mistakes. Good anti-spam protection reduces the volume drastically, but some still get through – that's not a weakness of a particular product, it's the nature of the problem.

On top of that, many attacks don't need malware at all. A fake login page where an employee enters their Microsoft 365 password, or a changed bank account on a genuine-looking invoice, is enough. The only thing that helps here is someone pausing, asking, and reporting.

We've summarized how to spot phishing emails in our checklist for employees. This article addresses the question behind it: how do you get your team to actually heed these warning signs in the hectic daily routine?

Building block 1: Awareness training that sticks

Short and regular instead of long and rare

A two-hour lecture once a year is forgotten within weeks. Short sessions of 15 to 30 minutes spread across the year are more effective. A sensible rhythm for SMEs:

• Onboarding: every new employee gets a short introduction to reporting channels, password rules, and common scams in their first week.
• Quarterly short session: one current topic per session, such as fake invoices, MFA push bombing, or QR code phishing.
• Ad-hoc alerts: when a wave of scams is circulating, a short all-staff email with a screenshot is often more effective than any training slide.

Real examples from your own inbox

Nothing is more convincing than a phishing email that actually reached your company. Collect intercepted or reported emails (without personal details) and use them in the next session. That way employees see that the threat is real and not taken from a textbook.

Tailor content to roles

Accounting is the preferred target for invoice fraud and CEO fraud, HR for booby-trapped job applications, management for targeted deception. A shared basic training for everyone, complemented by short deep dives for particularly exposed roles, addresses the actual risks better than a one-size-fits-all program. Read more about planning formats and content in our guide IT security training for employees.

Rules that make training effective

Training alone doesn't protect you if processes leave gaps. Three organizational rules belong with it:

• Four-eyes principle for payments: changes to bank details are always confirmed by phone using a known number – never via the contact details in the email.
• Multi-factor authentication for email, cloud services, and remote access. A password manager additionally prevents the same password from being used for several services.
• A simple reporting channel: a report button in the email client or a fixed address to forward suspicious emails to. The less effort reporting takes, the more often it happens.

Building block 2: Simulated phishing attacks – fair and educational

Training conveys knowledge; simulations show whether it holds up in everyday work. In a phishing simulation, employees receive realistic but harmless test emails. Anyone who clicks doesn't land on a malicious page, but on a short explanation of how the email could have been recognized.

How to set up simulations properly

• Inform people in advance: announce the program in the company – not the timing of individual emails, but the fact that simulations take place and what they are for.
• Involve data protection and the works council: before the first test email goes out, the data protection officer and – if present – the works council should know the concept. The goal is team-level reporting, not a performance assessment of individuals.
• Increase difficulty gradually: start with easily recognizable emails and slowly raise the level. Starting with perfectly faked emails frustrates the team.
• Choose realistic scenarios: parcel notifications, Microsoft 365 sign-ins, shared documents, internal memos – the things that actually happen day to day.

The right metric: report rate, not click rate

Many companies only look at how many employees clicked. More meaningful is how many reported the test email – and how quickly. A falling click rate is good; a rising report rate is better: it shows your team isn't just careful itself but actively warns others. In a real incident, that early report gives IT the time to stop a campaign before more colleagues fall for it.

No blame game

Anyone who clicks during a simulation must not be exposed for it. Otherwise the team mainly learns one thing: to keep mistakes quiet. And that is exactly the biggest risk in a real incident. With our Security Awareness & Phishing Simulation offering, we handle training, simulations, and reporting as a recurring service – without individual assessments and coordinated with data protection and the works council.

Building block 3: Rules of conduct for emergencies

Despite training, someone will click at some point. What matters is what happens in the next few minutes. Every employee needs short, unambiguous instructions for this – ideally printed out at their workstation, because during an attack the intranet and email may no longer be available.

Immediate steps when ransomware is suspected

Signs of ransomware include files that can no longer be opened or suddenly carry unusual extensions, a ransom note on the screen, or a computer that becomes noticeably slow while heavily accessing drives. Then:

1. Stay calm and stop working. Don't open any more files, don't delete anything.
2. Disconnect the device from the network: unplug the network cable and turn off Wi-Fi. This slows the spread to servers and other computers.
3. Don't shut the device down unless IT says otherwise. The running system often holds traces that are important for analysis.
4. Report immediately by phone – not by email. The email system may already be compromised, and an email might only be read hours later.
5. Write down what happened: time, opened email or file, messages displayed. A phone photo of the screen is enough.
6. Don't respond to the attackers, don't make contact, and don't pay anything. That decision is made solely by management together with experts.

Who needs to be notified?

When ransomware is suspected, fast and orderly communication is just as important as the technical response. Define the notification chain in advance and record a name, deputy, and phone number for each step:

1. IT contact or IT service provider – immediately, by the affected employee. IT contains the attack: isolates further systems, locks accounts, assesses the scope.
2. Line manager and management – immediately, in parallel with IT. Decisions on business interruption, communication, and external help lie with management.
3. Data protection officer – as early as possible. If personal data is affected, the breach generally has to be reported to the supervisory authority within 72 hours (Art. 33 GDPR), and in some cases to the data subjects as well (Art. 34 GDPR).
4. Cyber insurance (if any) – early, according to the policy terms. Many policies require immediate notification and provide their own incident responders. Acting on your own may put your coverage at risk.
5. Police – after initial containment. Every German state has a Central Cybercrime Contact Point (ZAC) for businesses. It takes the criminal complaint and supports securing evidence.
6. BSI or competent reporting office – if a legal reporting obligation applies. If your company falls under NIS2, for example, separate short reporting deadlines apply.

Important: the employee at the affected computer only needs to know the first two steps. Everything else is coordinated by IT and management. You can quickly assess whether your company falls under NIS2 with our NIS2 check.

Think notification chain and emergency plan together

The notification chain is only the beginning. Afterwards come questions nobody wants to settle during an emergency: which systems do we bring back up first? Who communicates with customers and suppliers? Where are clean backups? These answers belong in an IT emergency plan that is created beforehand and reviewed regularly. We explain how to build one in our guide IT emergency plan for companies.

Whether the procedures really work only shows in a test. An emergency drill with recovery test runs through exactly this scenario in a controlled way – including whether the phone list is still up to date.

Technical backup

The human firewall is the last line of defense, not the only one. To prevent a single wrong click from becoming a disaster, you need technical safety nets underneath:

• Managed EDR/XDR detects suspicious behavior on computers and servers, such as mass encryption of files, and can isolate affected devices automatically.
• Online backup outside your own network ensures data can still be restored even if local backups were encrypted too. A backup check with restore test verifies that restoring actually works.
• A managed firewall limits what a compromised computer can reach inside the network and on the internet.

An IT security check shows where your company stands overall – technically and organizationally.

Conclusion: security is teamwork

A human firewall isn't built on fear of mistakes, but on routine: regular short training sessions, fair simulations that encourage reporting, and a notification chain everyone knows. Combined with solid technology, the supposedly weakest link becomes your most attentive line of defense.

Would you like to introduce awareness training and phishing simulations in your company or put your emergency procedures to the test? Learn more about our approach in the IT security section – or get in touch directly via our contact page.