The most reliable defense is layered: require multifactor authentication (MFA), use phishing-resistant authentication for sensitive and privileged accounts, harden business email, limit each user’s access, maintain endpoints, and make reporting and response routine. A single filter, training session, or MFA setting cannot stop every phishing route.
Phishing may arrive by email, text, social media, phone call, or another message. The attacker may imitate a supplier, bank, colleague, executive, or technology provider, then ask for a password, payment, a file download, or an urgent change. Your objective is to make the first mistake difficult, make a stolen password less useful, and contain an account quickly when someone does submit credentials.
As an Amazon Associate I earn from qualifying purchases.
What a layered defense protects
Credential theft is an identity problem that can become a network problem. A stolen password can expose email, cloud storage, financial services, customer records, administrative consoles, and the other systems connected to that identity. Attackers can also use a compromised mailbox to send convincing follow-up messages from a real account.
Recommended Free Tools
Use the following layers together:
- Prevention: email filtering, sender-domain authentication, software updates, endpoint protection, and employee training.
- Authentication: unique passwords, MFA on every service that supports it, and phishing-resistant MFA for high-value accounts.
- Containment: least privilege, restricted administrator rights, prompt removal of obsolete access, and a rehearsed response sequence.
- Risk management: review the controls regularly rather than treating security as a one-time installation. NIST’s Cybersecurity Framework 2.0 small-business guidance presents security as an ongoing cycle of identifying, protecting, detecting, responding, and recovering.
Start with accounts that would cause the most damage if taken over: business email, finance and payroll systems, administrator accounts, remote-access services, and systems containing sensitive information.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Map the accounts and access that matter most
Before changing settings, make an inventory of the identities that can reach business systems. Include employees, contractors, service accounts, administrators, shared mailboxes, and emergency recovery accounts. For each account, record the service, owner, access level, MFA status, recovery method, and the person responsible for disabling it.
Prioritize high-impact identities
- Email accounts that can reset other passwords or approve transactions.
- Financial, payroll, billing, payment, and banking accounts.
- Cloud administration, domain management, identity-provider, and remote-access accounts.
- Accounts that contain customer, employee, health, legal, or other sensitive information.
- Executive and shared accounts that are commonly impersonated.
Use this list to stage the rollout. Protecting the administrator and email accounts first usually gives more risk reduction than enabling a less suitable control on a low-impact service while leaving a privileged login exposed.
2. Require MFA, then choose phishing-resistant authentication
Enable MFA wherever a service offers it. MFA adds a second barrier when a password is exposed, but the method matters. Some MFA prompts can still be relayed to an attacker or socially engineered from the user.
Free tools Windows power users keep installed
One-click scans. No signup required.
What “phishing-resistant” means
The National Institute of Standards and Technology (NIST) defines phishing resistance in SP 800-63B as follows: “Phishing resistance is the ability of the authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier (i.e., an attacker fraudulently posing as the verifier) without relying on the vigilance of the claimant.”
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Under that definition, a manually entered one-time password (OTP) and an out-of-band code do not qualify, because an attacker can persuade a person to enter or relay the value into a fraudulent sign-in page. Treat those methods as an improvement over a password alone, not as the strongest available protection.
Authentication choices compared
| Method | Phishing resistance | Where it fits | Deployment and recovery considerations |
|---|---|---|---|
| Password only | None | Do not use as the sole control for business accounts. | Requires unique, strong passwords and a safe recovery process, but remains vulnerable if disclosed. |
| SMS or voice code | Not phishing-resistant | Fallback when stronger methods are unavailable. | Plan for phone-number changes, SIM-swap risk, and loss of service. |
| Authenticator-app OTP | Not phishing-resistant under NIST’s definition | Useful as an interim MFA option. | Document device replacement and backup-code procedures; users must still protect and enter the code. |
| Push approval | Not automatically phishing-resistant | Convenient for broad MFA coverage. | Train users to deny unexpected prompts; repeated prompts can be used in push-bombing attacks. |
| FIDO authenticator with WebAuthn | Designed to resist phishing | Preferred for administrators, email, finance, and sensitive-data systems when supported. | Confirm identity-provider and service compatibility; enroll a backup authenticator and test account recovery. |
NIST identifies FIDO authenticators paired with WebAuthn as widely available. An authenticator may be built into a phone or laptop, or it may be a separate hardware device such as a FIDO2 security key. Compatibility depends on the identity provider, browser, device, and individual service; verify support before purchasing or issuing hardware.
Roll out MFA without creating a recovery crisis
- Confirm that the service supports the selected authenticator and that your sign-in policy can enforce it.
- Enroll the user’s primary authenticator while the existing sign-in method still works.
- Enroll and test a backup authenticator before removing the old method. Keep backup devices under controlled custody.
- Write down the help-desk or administrator procedure for a lost device, a new phone, or an employee who cannot sign in.
- Apply the strongest requirement to privileged and sensitive accounts first, then expand coverage to all users.
- Review recovery channels. An attacker who controls a weak recovery email address or phone number may bypass a strong primary factor.
CISA’s 2025 guidance recommends prioritizing phishing-resistant MFA for privileged users and centralizing logins around single sign-on (SSO) paired with MFA where the organization’s services support it. SSO can reduce the number of separate passwords, but it makes the central identity account especially important to protect.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →3. Harden business email against spoofing and malicious messages
Email controls address two different problems: blocking harmful content and making it harder for criminals to impersonate your domain. Configure the filtering features provided by your email service, and have the domain or email administrator verify sender authentication.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use SPF, DKIM, and DMARC together
- SPF publishes which systems are allowed to send mail for your domain.
- DKIM adds a cryptographic signature that receiving systems can check.
- DMARC tells receiving systems how to handle messages that fail the domain’s authentication and alignment rules, while providing reporting options.
NIST’s trustworthy-email guidance in SP 800-177 Rev. 1 treats these as complementary controls. They can reduce spoofing of your domain and help receiving providers reject unauthenticated messages, but they do not stop every phish. A criminal can use a look-alike domain, a compromised legitimate account, or a link to a credential-harvesting site that passes sender checks.
Set practical mail-handling rules
- Use provider filtering for malicious attachments, suspicious links, impersonation, and unusual sender behavior where those features are available.
- Make external-sender indicators visible so employees can distinguish an internal message from an outside one.
- Protect finance and executive workflows with a second verification channel. Confirm an unusual payment, bank-detail change, gift-card request, or urgent transfer using a known phone number or an established internal directory entry, never the contact information in the message.
- Give staff a simple report action or mailbox and explain what happens after a report. A reporting path that is difficult to find will be ignored under pressure.
4. Reduce what a stolen login can do
Assume that a convincing message will eventually reach someone. Limit the blast radius by ensuring that each identity can access only what its job requires.
Apply least privilege
- Separate everyday work accounts from administrator accounts.
- Use time-limited or task-specific elevation where the service supports it.
- Remove access promptly when an employee changes roles, leaves, or no longer needs a system.
- Review group memberships, shared drives, third-party integrations, and delegated mailbox access on a schedule.
- Do not give a vendor or contractor standing administrator access when a narrower permission will work.
Use unique passwords and a managed password process
Every account should have a unique, strong password so that one disclosure does not unlock unrelated services. A business password manager is a tool to consider for generating and storing unique credentials, especially for services that do not support SSO or phishing-resistant MFA. Protect the password-manager account with the strongest MFA available, document emergency access, and restrict who can retrieve shared credentials.
Never ask employees to send passwords through email or chat. When a password may have been exposed, change it through the service’s real sign-in page, revoke active sessions if the service offers that control, and investigate other accounts where the same password was used.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Keep endpoints and software maintained
Phishing often tries to persuade a user to open an attachment, install software, or visit a malicious page. NIST’s small-business guidance recommends maintaining antivirus software and applying updates. Keep operating systems, browsers, email clients, mobile devices, VPN software, and business applications on supported versions with automatic updates enabled where practical.
- Use centrally managed endpoint protection where available and ensure it reports failures or disabled protection.
- Remove software that is no longer supported or needed.
- Require updates on devices that access business accounts, including employee-owned devices covered by your policy.
- Back up important business data and test that recovery works; a backup does not prevent credential theft, but it can help recovery after a destructive follow-on action.
Antivirus and updates are supporting controls, not substitutes for MFA, email verification, or least privilege.
6. Train employees to pause, verify, and report
Training should answer three operational questions: Do employees know how to spot a phish? Are they regularly practicing the response? Do they know exactly how to report a suspected mistake?
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteTeach recognizable warning signs
- An unexpected link, attachment, sign-in request, or invoice.
- Urgency, secrecy, threats, or pressure to bypass normal approval.
- A request for passwords, MFA codes, payment, bank-detail changes, or sensitive data.
- A sender address, reply-to address, phone number, or website that is subtly different from the known organization.
- A message that asks the recipient to use a new channel or to ignore established procedures.
Explain that polished grammar, a familiar logo, or a message from a real compromised account does not prove legitimacy. Staff should open a new browser window or use a saved bookmark rather than clicking the message’s sign-in link, and verify unusual requests through known contact details.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Make reporting fast and blame-free
Publish one reporting route, such as a built-in mail-report button, a designated security mailbox, or an incident phone number. Tell employees to report even if they clicked, entered a password, approved an MFA prompt, or opened an attachment. Speed matters more than embarrassment; a quick report gives the organization a chance to reset credentials and contain access.
Use short, recurring reminders and exercises tied to real workflows such as invoices, shared documents, payroll, and executive requests. Record completion and follow up with people who need additional help, but do not punish good-faith reporting.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Prepare the response before a credential is stolen
Keep the response sequence accessible to employees and the people who administer identity systems. The first report may come from a frightened user, so the instructions must be clear and usable without technical vocabulary.
Immediate actions for a suspected disclosure
- Stop interacting with the message. Do not reply, click additional links, approve further prompts, or send more information.
- Notify the designated internal contact immediately. Include the account, time, device, message, links, attachments, and anything the user entered or approved. Preserve the message rather than deleting the only copy.
- Change the affected password through the legitimate service. Change every other account where that password was reused. Prioritize email and the identity account that can reset other credentials.
- Revoke access that may still be active. The administrator should disable or suspend the account when appropriate, terminate active sessions and tokens where the service permits, and remove suspicious forwarding rules or newly added recovery methods.
- Protect connected financial activity. Contact the financial institution immediately if a bank, payment, payroll, or card account was involved. Use a known number or the institution’s established website.
- Assess scope. Review sign-in history, mailbox activity, sent messages, file access, administrative changes, and other accounts controlled by the identity. Determine whether customers, employees, suppliers, or partners received fraudulent messages.
- Notify affected parties when appropriate. Coordinate with legal, privacy, insurance, and communications contacts. Breach-notification duties depend on the applicable law, location, information involved, and facts; check the relevant state attorney general information and obtain qualified legal advice.
- Document and improve. Record the timeline, controls that worked or failed, and the changes needed to prevent recurrence. Do not close the incident merely because the password was changed.
Prepare recovery details in advance
- Maintain current contact details for the identity provider, email administrator, financial institutions, incident lead, and legal or insurance contacts.
- Keep a tested break-glass administrator account protected by phishing-resistant MFA and monitored for use.
- Document how to recover a lost FIDO authenticator, replace a phone, reset an MFA enrollment, and restore a locked account.
- Give responders authority to disable an account quickly without waiting for a long approval chain.
Implementation roadmap for a small business
Use a staged plan so that important protections arrive quickly without leaving recovery procedures unfinished.
First week: close the largest identity gaps
- Inventory email, finance, administrator, remote-access, and sensitive-data accounts.
- Enable MFA on those accounts and remove shared passwords where possible.
- Set a designated phishing-reporting route and publish the suspected-compromise steps.
- Confirm that endpoint protection and automatic updates are active on devices used for business access.
First month: strengthen resistance and containment
- Deploy phishing-resistant FIDO authentication for privileged and high-impact accounts where supported.
- Enroll and test backup authenticators and recovery procedures.
- Review administrator rights, group memberships, delegated mail access, and departed-user accounts.
- Verify SPF, DKIM, and DMARC configuration with the domain or email administrator, then review available reports.
- Run a short awareness exercise focused on urgent payment, password-reset, and shared-document lures.
Ongoing: measure and rehearse
- Review MFA coverage, dormant accounts, privileged access, and recovery methods on a regular schedule.
- Repeat practical training and make reporting performance—not silent perfection—the goal.
- Test the credential-compromise response, including financial-contact escalation and account recovery.
- Reassess controls when adopting a new cloud service, changing an email provider, or granting a supplier access.
Questions every business should ask
- Do our employees know how to spot a phish, including messages from a real but compromised account?
- Are we regularly training employees to raise their awareness of phishing threats?
- Do employees know how to report if they think they have fallen victim to a phishing attack?
- Are we using phishing-resistant MFA for privileged users, email, finance, and sensitive systems?
- Can we disable a compromised account, revoke its sessions, and reset reused passwords immediately?
- Do we have a tested backup authenticator and a recovery path that cannot be reset through a weak channel?
- Have we limited administrator rights and removed access that people no longer need?
- Are SPF, DKIM, and DMARC configured for every domain that sends business email?
Limits to keep in mind
No control eliminates phishing. MFA can be bypassed through social engineering, push-bombing, stolen sessions, or weaknesses in account recovery; email authentication cannot stop look-alike domains or compromised legitimate accounts; and training cannot guarantee that a person will recognize every new lure. The practical goal is layered resistance: make deception harder, reduce the value of a stolen credential, detect misuse quickly, and give responders a practiced way to contain it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
