What email security do you put in place beyond what Microsoft includes?

Microsoft's built-in protection is decent and it is not enough on its own, because the attacks that actually cost small businesses money are the ones that look completely legitimate: a real message from a real compromised supplier, with no attachment and no malicious link, asking you to update payment details.

We use Avanan, now branded Check Point Email Security, on top of Microsoft 365. The difference that matters is where it sits. Traditional filtering sits in front of your mail and inspects messages on the way in, which means it never sees internal mail. Avanan sits inside the mailbox, so it also catches messages sent from one compromised colleague to another, which is exactly how an attacker moves once they are in.

What it adds over the defaults: better detection of business email compromise and lookalike domains, account takeover detection based on behavior rather than just content, the ability to pull a malicious message back out of mailboxes after delivery, and protection for files shared through SharePoint and Teams rather than email alone.

None of it removes the need for the human control on payment changes. Verify by phone, to a number you already had, every time.