One mission.
Outsmart
every threat.

Watch for unexpected requests, pressure to act quickly, unusual payment instructions and links or attachments you were not expecting. A familiar sender name does not prove a message is genuine. Verify sensitive requests through a separate, trusted channel using contact details you already know. Report suspicious messages through your organisation’s agreed process.

No. MFA adds an important layer of protection, but attackers may still steal an authenticated session, trick someone into approving a request or exploit account recovery. Prefer phishing-resistant passkeys or security keys where supported. Never share verification codes or approve a sign-in you did not initiate.

Activate your incident response process immediately and contact your IT or security team through a trusted channel. Isolate affected devices from networks where safe and practical, and stop using them. Preserve evidence and keep a record of what happened. Avoid wiping systems or starting an uncoordinated recovery; those decisions should be led by the incident response team.

A backup must be available, protected from the affected environment and proven to restore the information you need. Maintain isolated or immutable copies where practical, restrict backup administration and test restoration regularly. Agree how much data loss and downtime the business can tolerate before an incident occurs.

Enable supported automatic updates where appropriate and maintain an inventory of your systems. Prioritise actively exploited vulnerabilities and internet-facing services, using vendor guidance and a risk-based patching process. Test changes where needed, verify that updates were applied and replace unsupported software.

Use long, unique passwords for each account, stored in a reputable password manager, and enable MFA. Remove unnecessary accounts and permissions. If a password may have been exposed, change it from a trusted device and have your IT team review active sessions, recovery settings and related accounts.

Define how incidents are reported, who leads the response, how decisions are escalated and how people communicate if normal systems are unavailable. Include evidence preservation, containment, recovery priorities and trusted external contacts. Exercise the plan with the people who will use it and update it after lessons learned.