AegisAI Perspectives · 107
A small manufacturer with one or two IT staff runs email security as a weekly routine: turn on built-in controls, automate reports, skip rule writing.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
A small plant runs email security as a weekly routine: switch on what the license includes, automate reports, and skip daily rule writing. Phishing led 2024 complaints to the FBI, with 193,4074. AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery19, with no change to mail routing (MX records). Use the routine below to fit email security into the hours a team of one or two has.
Print these three points and keep them next to the plant's IT task list.
The FBI describes business email compromise as a scam targeting businesses working with suppliers or regularly performing wire transfer payments3. In 2024, IC3 recorded $2,770,151,146 in business email compromise losses from 21,442 complaints.
A cyber insurance adviser quoted by the NAM said about a third of attacks on small and medium businesses focused on manufacturers10. The guide to email security for manufacturing covers the wider sector picture. Put supplier payment changes at the top of your email risk list.
Short on time? Watch the explainer, or book a demo.
Switch on multi-factor authentication first. NIST calls enabling MFA one of the fastest, cheapest ways to protect your data12, and NIST says to prioritize requiring it on all accounts that offer it.
Next, turn on SPF and DKIM, because Google requires them before you can use DMARC16. Let DKIM and SPF authenticate messages for at least 48 hours before turning on DMARC. In Microsoft 365, Standard and Strict preset security policies are likely off on your first visit to the page14. Open that page this week and record which presets are on.
Automate the report loop, because it turns every employee into a sensor without adding a queue. NIST tells small businesses to show staff how to report attacks or suspicious activity5. In Microsoft 365 with Exchange Online mailboxes, you can set a reporting mailbox to hold messages users report in Outlook15.
In Google Workspace, Gmail by default displays warnings and moves untrustworthy emails to the spam folder18. Name one person who reads the reporting mailbox every week, and one backup.
Protect supplier bank-detail changes with a process, not a filter. Business email compromise targets businesses that work with suppliers and pay by wire, so a changed bank account in an email is the signal to stop. Require a call-back to a phone number already on file before accounts payable changes any supplier's bank details.
Shared plant-floor mailboxes need the same MFA as desk accounts. Staff on the floor have no desk, so put the reporting steps on a printed card at each shared terminal. Add every shared mailbox to the MFA rollout list today.
Skip anything that needs daily rule writing or a staffed alert queue. The guide to email security for a lean IT team with no SOC scores options on the work they leave a small team.
The NIST MEP Cybersecurity Assessment Tool lets U.S. small manufacturers self-evaluate their cyber risk11. Run that assessment once, then drop any email tool that needs more weekly hours than you have.
Block one recurring slot each week and work through these steps in order.
Read the reporting mailbox and close each report with a verdict.
Check that every new account, including shared plant-floor mailboxes, has MFA.
Confirm the Microsoft 365 preset security policies you chose are still on.
Check DMARC reports for mail sent in your domain's name that failed SPF or DKIM.
Review any supplier bank-detail change request from the week against the call-back log.
Remove any reported phishing email from every inbox it reached.
Write down the week's three numbers from the measurement list below.
Keep the routine to one slot, and move any step that runs long to an automated tool.
Score built-in controls alone and an added API layer on the work each leaves you.
| Criterion | Built-in Microsoft 365 or Google Workspace controls | AegisAI |
|---|---|---|
| Mail routing | Unchanged | No change to mail routing (MX records) |
| Starting state | Standard and Strict presets likely off at first visit | Runs in monitoring mode first |
| Rules to maintain | Policies an admin sets and reviews | Nothing to write or maintain as attacks change |
| Removal after delivery | Admin action per message | One bad email is pulled from every inbox it reached, forwards included |
| Verdict explanation | Gmail warnings by default | Every verdict comes with its reason in plain language |
| MFA and DMARC setup | Done in the platform admin console | No edge: these stay in your platform admin console |
Score your plant on all six rows, and use the demo request page to see the monitoring mode on your own tenant.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery. It runs in monitoring mode first. One bad email is pulled from every inbox it reached, forwards included. Removal needs write access your admin grants and can revoke22.
Illustrative example, figures are fictional. A 140 person parts plant has one IT manager and a part-time helper. On a Tuesday, accounts payable receives an email from a known supplier's address asking to move payments to a new bank account. The clerk reports it through the reporting mailbox and calls the supplier on the number on file. The IT manager finds the same email in 6 inboxes, including one shared plant-floor mailbox, and removes all 6. The weekly routine logs one blocked payment change and one shared mailbox without MFA, which gets MFA that day.
Walk your accounts payable clerk through this scenario before the next supplier payment run.
Track three numbers each week in tools you already have.
Review all three on day 30 and fix the lowest one first.
Run it as a weekly routine. Switch on MFA, SPF, DKIM and DMARC, automate user reports into one reporting mailbox, and skip tools that need daily rule writing or a staffed alert queue.
MFA, because NIST calls it one of the fastest, cheapest ways to protect your data. Then SPF and DKIM, then DMARC after at least 48 hours of authentication.
On your first visit to the preset security policies page, Standard and Strict protection are likely off. Open the page and record which presets apply to which users.
Treat it as a stop signal. Business email compromise targets businesses that pay suppliers by wire. Call the supplier on the number already on file before changing any bank details.
The NIST MEP Cybersecurity Assessment Tool lets U.S. small manufacturers self-evaluate their cyber risk. The guide to choosing email security for a small or mid-sized business covers the buying side.
