Yet, implementing this measure does not require budget, software, or service. All it takes is to send out an email or internal notice three to four times a year reminding your staff how important it is to refrain from clicking on a link in an email, from opening an attached file that is not expected or containing an unknown extension.

Yes, you read correctly, your staff using their IT tools is your last line of defence. They must react as soon as they have a doubt or suspicion and must never think twice about calling your IT team or IT consultant.