Email is where most attacks on small businesses begin — phishing, payment fraud, malware delivery, consent tricks — and the persistent fantasy is that some single product stops it: the right filter, the right training, the right anything. The reality every security team eventually internalizes: each defense catches a category and misses the rest, so real email security is a stack — five layers, each assuming the one above it will sometimes fail. Here’s the model, vendor-neutral; the Microsoft 365-specific build-out has its own article.
Layer 1: Authentication — proving who’s who
Before judging a message’s content, verify its origin: SPF, DKIM, and DMARC on your own domain stop criminals from sending as you, and your inbound filtering leans on everyone else’s records to catch impostors. This layer is foundational precisely because it’s binary and cheap — a DNS project, not a subscription — and because exact-domain spoofing, the most convincing impersonation there is, dies entirely at DMARC-reject. What passes through: lookalike domains and compromised real accounts, which is why layers exist.
Layer 2: Filtering — judging the message
The workhorse layer: reputation, content analysis, and increasingly behavioral judgment (“this claims to be the CEO but originated externally”; “this vendor never wrote like this”) applied to every inbound message. Modern filtering catches the overwhelming bulk — the spam, the commodity phishing, the known-bad — and its honest limitation is arithmetic: filtering plays percentages against attackers who test their campaigns against the major filters before sending. The well-crafted few get through by design. The buying note: “we have spam filtering” and “we have modern anti-phishing with impersonation protection” are different products wearing the same folder name; know which one you own.
Layer 3: Links and attachments — judging the payload
The dangerous email usually carries its danger in a click: a link to a credential harvest page, an attachment with a surprise. This layer inspects both at a depth inline filtering can’t — links rewritten and re-checked at click time (catching the URL that turned malicious an hour after delivery, a standard attacker trick), attachments detonated in sandboxes before release. What passes: the phish with no payload at all — the pure-persuasion BEC message that’s just text asking someone to do something. No scanner flags a polite sentence, which hands the problem to:
Layer 4: People — judging the request
The layer every technical bypass lands on: a human deciding whether to comply. Trained, practiced people who recognize the red flags, verification rules that make the money-moving requests call-to-confirm, and — the crown jewel — a reporting culture where “this looks weird” reaches IT in minutes. This layer’s quality isn’t measured by click rate; it’s measured by report speed, because one early report is what activates the final layer:
Layer 5: Response — limiting what a success costs
Some attack eventually lands — the layer-5 question is what happens next, and the answers are all about containment speed: the reported phish purged from every inbox before the second click (a one-button capability in modern platforms, worth more than most appliances) · MFA making the stolen password insufficient · sign-in anomalies and new forwarding rules alerting someone · EDR catching what the click executed · and a rehearsed compromised-mailbox playbook for the confirmed cases. Layer 5 is why mature programs treat a caught incident as the system working — the layers are designed so that failure at any one is survivable at the next.
Reading your own stack
The model doubles as an audit: walk the five layers and mark each strong / partial / absent for your business. The common small-business profile is strong-2, partial-4, absent-1-3-5 — filtering alone, carrying weight it was never meant to carry alone. The fix order by value: authentication first (cheap, permanent), then the people layer (highest return per dollar), then click-time protection, then response mechanics — most of it configuration and habit rather than new spend, which is the pleasant surprise of the whole model.
The bottom line
Email security isn’t a product category; it’s a stack: prove origins, filter content, inspect payloads, prepare people, and rehearse response — each layer catching what the last one missed. No layer is optional because no layer is sufficient, and the businesses that internalize that stop asking “which email security should we buy?” and start asking the better question: “which of our five layers is thinnest?”