Email security · Edmonton
Stop phishing, fake invoices and impersonation before they reach your team. We secure Microsoft 365, Google Workspace and Zoho mail, lock down your domain with SPF, DKIM and DMARC, and train staff to spot what still gets through.
Mail protection status
● Protected
Inbound filtering
Scanning
Links & attachments
Checked
Impersonation
Blocked
SPF · DKIM · DMARC
Aligned
Sign-ins + MFA
Enforced
Microsoft Defender
Configured for Office 365
Advanced filtering
Third-party filtering when needed
DMARC monitoring
Reports reviewed, not ignored
Phishing simulations
Ongoing staff training
Why email is still the way in
The most damaging emails don’t look dangerous. They look like a vendor updating their banking details, a manager asking for a quick transfer, or a Microsoft sign-in page. No attachment, no spelling mistakes, nothing for a spam filter to catch.
That’s why email security has to combine filtering, domain authentication, account protection and people who know what to look for. And because most fraud is never reported, the real losses are much higher than the official numbers.
5–10%
of frauds are actually reported, so the real losses are far higher.
Source: Canadian Anti-Fraud Centre, 2026
#1
Scams and fraud remained the most common method behind cyber incidents at Canadian businesses in 2023.
Source: Statistics Canada, 2024
What we protect against
Modern attacks are polished, personalized and often come from real, compromised accounts. These are the threats we design protection around.
Fake sign-in pages and alerts designed to steal Microsoft 365 or Google passwords.
A real-looking invoice or a request to update banking details sends your money to a criminal.
An urgent request that seems to come from the owner or a manager: gift cards, wire transfers, payroll changes.
A stolen password lets an attacker read mail, set hidden forwarding rules and phish your contacts from inside.
Without DMARC enforcement, anyone can send email that claims to come from your domain.
Malware and ransomware delivered through links, shared files and booby-trapped documents.
Microsoft 365 email security
Every Microsoft 365 mailbox has built-in protection against known spam and malware. Stopping targeted phishing and business email compromise takes Microsoft Defender for Office 365, configured properly, which you may already be paying for through your Microsoft 365 plan.
| Built-in protection | Defender for Office 365 Plan 1 | Defender for Office 365 Plan 2 | |
|---|---|---|---|
| What it’s for | Broad, volume-based, known email attacks | Zero-day malware, phishing and business email compromise | Everything in Plan 1, plus investigation, hunting and response |
| Phishing simulations | No | No | Yes, attack simulation training |
| Who has it | Every Microsoft 365 cloud mailbox | Included in some plans, such as Microsoft 365 Business Premium | Higher-tier plans or an add-on licence |
Worth knowing: Microsoft doesn’t DKIM-sign outbound mail from your own domain until it’s set up, so if nobody has set it up, your email is going out unsigned. If you don’t have Plan 2, we provide phishing simulations and training separately.
Protect your domain
SPF lists who’s allowed to send as your domain. DKIM signs each message so it can’t be altered. DMARC tells receiving mail servers what to do with email that fails those checks, and sends you reports.
Canada’s Cyber Centre recommends a DMARC policy of reject, because only reject at 100% stops all illegitimate messages. Gmail now requires every sender to use SPF or DKIM, and bulk senders to Gmail and Yahoo must also publish DMARC. Getting this right also fixes a common cause of business email landing in spam.
Step 1
Inventory every service that sends as your domain: Microsoft 365, your CRM, billing, website forms, newsletters.
Step 2
Publish a correct SPF record and turn on DKIM signing for each legitimate sender.
Step 3
Start at p=none and read the DMARC reports to catch anything we missed, without blocking real mail.
Step 4
Move to quarantine, then reject, so spoofed email claiming to be you is refused.
Email security services
We secure the whole path, from your domain’s DNS records to the inbox, the sign-in and the person reading the message.
Anti-phishing, impersonation, Safe Links and Safe Attachments policies configured and tuned for your licensing.
Phishing, spoofing and attachment protection, plus authentication, for Google and Zoho mail too.
A third-party filtering layer in front of your mailboxes when built-in protection isn't enough.
Domain authentication set up correctly and moved to enforcement without breaking legitimate mail.
We use a DMARC monitoring platform to review reports and catch spoofing and misconfigured senders.
Multifactor authentication and sign-in policies so a stolen password alone can't open a mailbox.
Realistic simulated phishing and short training so staff recognize and report suspicious email.
Compromised mailbox? We contain it, remove the attacker's access and rules, and find out what was exposed.
Backups of mailboxes so deleted or encrypted email can be recovered.
Business email compromise
Business email compromise often uses a genuine, hacked account or a near-perfect lookalike, so technology alone can’t catch every case. The Canadian Anti-Fraud Centre’s advice for businesses is simple and it works:
Sources: Canadian Anti-Fraud Centre.
Patient information in email is a target. We secure clinic mailboxes and support your Health Information Act obligations.
Progress invoices, holdbacks and supplier payments make construction a prime target for changed-banking-details fraud.
Large client transfers and trust payments attract impersonation attempts. Verification steps and protected accounts matter.
Client data and frequent invoicing make every mailbox valuable. Lock down accounts and the domain.
When something gets through
No email platform can block everything. What matters is how fast a compromised mailbox is contained and cleaned up.
Step 1
A user or our monitoring flags a suspicious message or sign-in.
Step 2
Reset passwords, revoke sessions and block the sender.
Step 3
Review sign-ins, mailbox rules, forwarding and what was accessed.
Step 4
Purge malicious messages and remove the attacker's rules and access.
Step 5
Restore secure access and get the user working again.
Step 6
Close the gap that let it happen: policy, MFA or training.
If money has been sent, call your bank immediately, then report the fraud to police and the Canadian Anti-Fraud Centre.
Cost
Sometimes less than you’d expect: your Microsoft 365 plan may already include protection that has never been configured. We start with a free review of your current setup and quote in writing, separating any new licences from our work.
Why AlphaIT
We look after the whole picture: mail platform, domain, identity, devices and network. A phishing email that slips past one layer still has to get past the others. And because we’re local, we can sit down with your team for training, not just send a video link.
Edmonton, St. Albert, Sherwood Park, Spruce Grove, Stony Plain, Leduc & Nisku, Fort Saskatchewan, Beaumont and Acheson.
Frequently asked questions
Straight answers about phishing, Microsoft 365 protection, DMARC and what to do when something gets through.
Microsoft 365’s built-in protection handles broad, known spam and malware. Targeted phishing, zero-day malware and business email compromise need Microsoft Defender for Office 365, which is included in some plans such as Microsoft 365 Business Premium, and it only helps if it’s configured properly.
Plan 1 protects against zero-day malware, phishing and business email compromise, including Safe Links and Safe Attachments. Plan 2 adds attack simulation training, investigation, threat hunting and automated response.
SPF lists the services allowed to send email for your domain. DKIM adds a digital signature to prove a message wasn’t altered. DMARC tells receiving servers what to do with email that fails those checks and sends you reports about who is sending as your domain.
Start at p=none to monitor, fix any legitimate senders that fail, then move to quarantine and finally reject. Canada’s Cyber Centre recommends reject, because only a reject policy at 100% stops all illegitimate messages from being delivered.
Missing or broken SPF, DKIM or DMARC is one of the most common causes. Gmail, Yahoo and Outlook.com now expect senders to authenticate their email. We check your records and every service that sends as your domain.
Not always. Many businesses get strong protection from properly configured Microsoft Defender. A third-party filtering layer makes sense for higher-risk businesses or platforms with lighter built-in protection, and we’ll recommend one only if you need it.
Yes. We secure Microsoft 365, Google Workspace and Zoho Mail, including domain authentication, sign-in protection and filtering.
Be suspicious of any change to banking details, urgent payment requests or slightly-off sender addresses. Always confirm payment changes by calling a phone number you already have on file, never one in the email.
Reset the password, sign the user out everywhere and call us. We remove forwarding and inbox rules the attacker created, check what was accessed and warn affected contacts. If money was sent, call your bank immediately and report it to police and the Canadian Anti-Fraud Centre.
Yes, when it’s ongoing. Short, regular simulations and training help staff recognize and report suspicious email, which matters because some phishing will always reach an inbox.
Yes. We review your DNS authentication, Defender or platform policies, impersonation protection, quarantine, MFA and sign-in settings, then show you the gaps in order of priority.
No product can guarantee that. Layered protection, MFA, trained staff and fast incident response together make a successful attack much less likely and much less damaging.
Free email security review
We’ll check your SPF, DKIM and DMARC records, your Microsoft 365, Google or Zoho security settings, sign-in protection and phishing exposure, then show you what to fix first. No obligation.
780-318-0149
Edmonton, AB · serving the Edmonton region
