Three threats small businesses should plan for

Based on Microsoft Security research published in September 2026, here is what is happening and what helps.

1. Invisible-text phishing

Attackers hide special characters inside lure words so filters miss them. Layered filtering still caught most of it. Keep Standard or Strict anti-spam presets on, and block rotating domains.

2. AI-assisted fake invoices

Messages impersonating executives pushed finance staff to approve payments. Turn on impersonation protection and mailbox intelligence, and require a call-back before any change to bank details.

3. Fake helpdesk calls

Staff were called on personal phones and guided to hand over a valid session. Require phishing-resistant MFA, block risky sign-in flows, and give staff a verified way to report suspicious contact.

We use Microsoft Secure Score to track these fixes. Learn about our security assessments.