Most of the cyber issues I see don’t start with alarms going off or systems falling over. It’s usually something that felt routine at the time.
An email that looked right.
A login that didn’t raise any questions.
A quick approval to get on with the day.
Nothing about it feels like the start of a problem. It usually starts with something small.
A normal-looking email.
A link that feels routine.
A login page that looks exactly like Microsoft 365.
Someone clicks.
Signs in.
Carries on with their day.
That’s it.
So what actually happens after a phishing click?
In most cases, nothing obvious. That’s what catches people out.
There’s no crash.
No locked screen.
No message saying something’s wrong.
Behind the scenes, though, a few things can happen very quickly.
1. The login is captured
If it’s a fake Microsoft 365 page, the username and password are taken straight away.
If MFA is in place, the attacker often captures that too. Not by “breaking” it – just by tricking the person into approving it.
2. Access looks legitimate
The attacker signs in.
From the system’s point of view, it’s just a normal login.
Correct username.
Correct password.
MFA approved.
Nothing unusual… unless someone is actually looking for it.
3. Small changes start happening
This is where things start to drift.
Inbox rules get created
Emails get forwarded quietly
Replies are intercepted
New devices or sessions appear
All subtle. Easy to miss.
4. The real impact comes later
Days or weeks later, it shows up as:
- A supplier chasing a payment that was never received
- A client questioning a strange email
- Missing emails or unexpected changes
- Locked access or wider disruption
At that point, the “click” feels like a long time ago.
“But we’ve got MFA…”
This is the part that causes confusion. MFA is important. You absolutely need it, but it doesn’t stop everything.
Why MFA isn’t stopping these attacks
MFA is designed to confirm identity.
The problem is, if someone is tricked into approving a login, the system thinks everything is fine. That’s how attackers get around it.
Not by breaking MFA
But by working with it
Common ways this happens
- Fake login pages that prompt for MFA
- “Session hijacking” where access is reused
- OAuth apps requesting access quietly
- Push fatigue (“approve this sign-in”)
From the outside, it looks like a normal user.
What we often see
Across businesses in Chesterfield, Sheffield, Derbyshire and South Yorkshire, the pattern is usually the same:
MFA is enabled, but nothing is watching what happens after login
Email is protected, but identity behaviour isn’t monitored
Backups exist, but they don’t help with account misuse
Security tools are in place, but no one is joining the dots
What actually reduces the risk
It’s not about replacing MFA.
It’s about adding the missing layer around it.
1. Visibility on logins and behaviour
Someone (or something) needs to see:
- Unusual login locations
- New sessions or devices
- Suspicious inbox rules
- Unexpected account activity
Without that, everything looks normal.
2. Better email filtering
Reducing the number of phishing emails that get through in the first place makes a big difference.
Fewer risky clicks.
Fewer chances for things to start.
3. Endpoint awareness
If a device is compromised or behaving unusually, that needs to be visible too.
Not just blocked – understood.
4. Backup as a safety net
Backup doesn’t stop a phishing attack , but it does reduce the damage if data is deleted, encrypted or lost.
5. Practical awareness (not blame)
People don’t click links because they’re careless.
They click because:
- they’re busy
- it looks familiar
- it fits the moment
Good awareness helps reduce that, without making people feel like the problem.
The real issue isn’t the click
It’s what happens next.
If no one sees it
If nothing flags it
If there’s no response
That’s when a small moment turns into a bigger problem.
Most businesses I speak to aren’t wildly insecure. They’ve got some of the right things in place, but there are gaps and those gaps are usually where issues start.
Want a clearer view of where your cyber risk really sits?
If this feels familiar, a quick review can help highlight where the gaps are, what is already working, and what is worth improving next.
