It is 4:17 on a Friday afternoon at a family owned manufacturer outside Albany.

Alex runs accounts payable. An email lands from the owner: "Need the new routing and account numbers for Peterson before you head out. Want this done today."

The name is right. The tone is right. Everyone is trying to close out the week, and the easiest thing in the world is to reply.

The owner is at his kid's soccer game and has not touched email since noon.

Your IT team can put strong protections in front of that inbox, and they should. But no tool decided whether Alex hit reply. Alex did. Some of the most important security decisions in your company are made by people who have never once thought of themselves as part of the security team.

The assumption that leaves businesses exposed

Ask most owners where cybersecurity lives and they will point somewhere out of sight. The provider installed things. The laptops have that shield icon. Updates run at night.

It is handled. Or so the thinking goes.

The tools do their job. They block a large share of attacks before anyone sees them. What they cannot do is decide, on your employee's behalf, whether a request that looks normal actually is.

Why do phishing emails get through good security tools?

Because the dangerous ones do not contain anything a filter can catch. No malware, no bad link, sometimes no link at all.

Just a plain text request from a name the recipient trusts, asking for something that sounds routine. A filter scans for threats. A person has to recognize a bad request.

Technology cannot make every call

Today's phishing does not look like phishing. It matches the writing style of the person it imitates, references a vendor you actually use, and shows up in the rhythm of a normal business day.

A payment request from the CEO. A vendor changing bank details mid project. A teammate asking for access to a folder they have never opened.

Each of those happens legitimately every week. Each is also a common attack, and someone at a keyboard has to tell the difference in a few seconds.

That is not a technology problem. That is a judgment problem, and judgment can be taught.

"Be careful" is not a plan

Most businesses tell their people to watch out for suspicious emails. Fewer tell them what to do when they find one.

Every employee, from the front desk to the controller, should be able to answer these without thinking:

  • Who do I contact when something feels off?
  • How do I verify a request without using the contact information in the message itself?
  • What do I do if I already clicked or already replied?
  • How do I report it, and will I get in trouble for asking?

What should an employee do when an email request feels off?

Stop, and verify through a channel the sender did not provide. Call the person at a number you already have, walk down the hall, or send a fresh message to an address you know is real. Never reply to the suspicious message or use a phone number inside it.

Then report it, even if it turns out to be legitimate. A false alarm costs two minutes. A quiet mistake costs a great deal more.

Warning people to be careful and stopping there hands the hardest call in the building to whoever happens to be holding the mouse, with no backup. Someone who does not want to bother the boss stays quiet. Someone who fears blame waits. The time lost while an employee decides whether to speak up is what turns a small incident into a large one.

How should a business verify a request to change payment details?

Treat every change to banking or payment information as unverified until confirmed by phone with a known contact at a number on file, not one supplied in the request. Put that rule in writing, apply it to the owner's own requests too, and make the callback the normal step rather than the awkward one. CPA firms and manufacturers with vendor payment cycles are hit with this constantly, and the callback is the single control that stops it.

Leadership sets the tone

Employees take their cues from the top. If the owner skips verification because they are in a hurry, the team learns that speed beats process. If a manager makes it uncomfortable to flag something, people stop flagging. If someone clicks the wrong thing and gets called out in front of the room, everyone learns to hide their mistakes.

The reverse is just as true. When the owner says, "Good, you called to check," the whole company hears it. When the person who raised a false alarm gets thanked instead of teased, the next real alarm gets raised faster.

How does leadership affect a company's cybersecurity?

More than any tool. Leadership decides whether verification is normal or annoying, whether reporting a mistake is safe or career limiting, and whether the rules apply to the owner. A company where the CEO cheerfully takes a callback on their own wire request has a culture that will catch fraud. A company where that callback feels insubordinate does not.

Everyone knows their role

Back to Alex at 4:17 on Friday.

The goal is not paranoia about every email. It is a team that knows, when something feels off, exactly what to do, who to ask, and how to check. Speaking up should always feel like the right move, and it should never feel like an accusation.

Your people do not need to become security experts. They need clear expectations, a few good habits, and confidence that raising a hand is welcome.

One annual training video does not build any of these. What works is short, regular reinforcement: a monthly reminder, occasionally simulated phishing with coaching instead of punishment, and a written process people can find in thirty seconds.

That kind of culture takes more than a training license. It takes the right safeguards in place, a practical process people will actually follow, and someone paying attention as the threats change.

10D Tech provides managed IT services and cybersecurity for businesses with 10 to 250 employees across Oregon and southwest Washington, from Portland and Salem through Albany, Corvallis, and Eugene to Bend. The work with healthcare practices, credit unions, law firms, and manufacturers starts the same way every time: an honest look at where the gaps are.

Should a small business outsource cybersecurity?

For most companies under 250 employees, yes, at least in part. Security needs someone watching every day, and an internal person with another full time job cannot do that. A managed IT provider supplies the monitoring, the tools, and the process. What stays in house is culture: the callback habit, the leader who says thank you for checking, and the rule that applies to the owner too. Outsource the watching. Keep the culture.

If you are not sure whether your team would speak up on a Friday afternoon, that is worth knowing before it matters. A complimentary 15 minute Technology Confidence Score call gives you a clear picture of where your systems stand today, along with your score out of 100. See how the Score works at 10dtech.com/aspirin, then schedule at https://www.10dtech.com/Tech_Confidence_Score. Albany, Corvallis, Eugene, Bend: 541-243-4103. Portland, Salem: 971-915-9103.