Phishing Defence: NCSC Four Layers Explained

Most phishing advice tells staff to be careful what they click. The UK National Cyber Security Centre (NCSC) takes a different view: defences should not rely mainly on users spotting phishing, and organisations should plan for some attacks to get through. This guide summarises the NCSC's guidance, "Phishing attacks: defending your organisation". It supports our Phishing, Social Engineering and Business Email Compromise course overview, and follows our guides to business email compromise and Cyber Essentials.

About the guidance

The guidance was first published on 5 February 2018, was last reviewed on 13 February 2024 (version 2.0) according to the page we read, and is aimed at medium to large organisations. It recommends a layered approach that combines technology, process and people, built around four layers.

Layer 1: make it difficult for attackers to reach users

The NCSC recommends anti-spoofing controls, namely DMARC, SPF and DKIM, to stop attackers impersonating your domain. It also recommends limiting publicly available information that could support spear phishing or whaling against senior staff, with a digital footprint policy, and filtering or blocking malicious email on the server by default, honouring senders' DMARC quarantine or reject policies.

Layer 2: help users identify and report phishing

Here the guidance suggests targeting training at higher-risk departments, such as those handling finance or IT administration, and teaching common phishing features rather than relying on simulations alone. It recommends verifying important email requests through a second channel, such as a phone call, and changing processes where possible, for example sharing files through access-controlled cloud accounts instead of attachments. It also recommends a simple, quick reporting process and avoiding a blame-oriented culture. For finance teams, the second-channel point is the one that most directly addresses payment-diversion fraud.

Layer 3: protect the organisation from undetected phishing

• Keep software and devices patched and supported, and limit administrator accounts.
• Use browser protections and a proxy service to block known malicious sites.
• Deploy multi-factor authentication, and consider password managers, single sign-on, or stronger methods such as biometrics or smartcards.
• Apply least privilege, review access regularly and remove unused accounts.
• Review password policies, for example to reduce reuse across work and personal accounts.

Layer 4: respond quickly to incidents

The fourth layer asks organisations to detect incidents through security logging, to make sure users know how to report incidents even if their normal communications are compromised, and to maintain and regularly exercise an incident response plan. The NCSC suggests its free Exercise in a Box tool for exercising the plan.

What the NCSC says about simulations

The guidance is cautious about phishing simulations. It says simulations are not a substitute for technical controls, and that no training can teach users to spot every phishing attempt. It advises checking with HR before running simulations, because punishing staff for clicking may create legal risk. It says blaming users for clicking does not work, and that fear of punishment discourages reporting. It suggests measuring reporting as well as clicks, and focusing on how many people reported the message.

The case study: why one layer is not enough

The NCSC gives a case study of a financial sector company with about 4,000 employees that received a Dridex malware campaign. Of 1,800 emails sent, 1,750 were stopped by filtering and 50 reached inboxes. Twenty-five were reported in total, including some after clicking, and 14 were clicked, launching malware. Thirteen of those failed to run because devices were up to date. One malware installation occurred, its call home was detected and blocked, and the device was cleaned within a few hours. The NCSC uses the example to show that relying on any single layer would have missed some attacks.

Where a small team might start: our suggestion

The four layers can feel like a large programme. In our reading, the guidance implies that the cheapest early gains are the ones that do not depend on staff behaviour: blocking spoofed email with DMARC, SPF and DKIM, turning on multi-factor authentication, and keeping software patched. The reporting button and the second-channel check on payment requests then cover what gets through. This is our interpretation of how the layers fit, so adapt it to your own risk assessment.

Using this in a finance or compliance role: our suggestions

These steps are our suggestions, not requirements in the NCSC guidance.

• Check whether your domain has DMARC, SPF and DKIM set up and enforced.
• Add a rule that changes to supplier bank details are verified by phone using a number held on file.
• Track how many staff report suspicious messages, not only how many click.
• Test whether staff know how to report if email is down.

For structured learning, browse our CPD courses.

What we could not confirm

We read the NCSC web page, not the PDF version of the guidance, and the NCSC lists a 2026 PDF that we did not compare with it, so the wording may differ. The statistics come from the NCSC's own case study and describe one organisation. The guidance targets medium to large organisations, and smaller ones are pointed to the NCSC Cyber Action Toolkit, which we did not read. This post is general information, not security or legal advice.