Most businesses are not, because they rely on one layer of defence and one careful employee. A single click on a convincing email can install malware, hand over a password or start a ransomware attack that stops orders, payroll and email for days. AI has made those emails far more convincing: in a 2024 study by Heiding and colleagues, fully AI-automated spear-phishing emails were clicked 54% of the time, against 12% for generic phishing. The answer is layers, so that one mistake is caught by the next control: email and DNS filtering before the click, a firewall such as a Fortinet FortiGate and endpoint protection after it, MFA to limit stolen passwords, network segmentation to stop spread, and isolated backups to recover. At SourceIT, the FortiGate 50G with 1-year Unified Threat Protection is S$1,819.20 (listed 30 Oct 2026).
How does one click become an outage?
- The lure. An email, chat message or fake web page, often well written by AI and timed around a real event such as an invoice or a delivery.
- The click. The user opens a link, enters a password on a fake login page, or follows instructions to paste a command. Microsoft's 2025 Digital Defense Report found this "ClickFix" trick was the most common initial access method its experts saw.
- The foothold. Malware runs, or the attacker signs in with the stolen password, sometimes bypassing MFA with kits such as Tycoon 2FA.
- The spread. The attacker moves across the flat office network to file servers, backups and other PCs.
- The impact. Data is stolen and files are encrypted, and the company is told to pay.
Every step is a chance to stop it. Sophos's State of Ransomware 2026 survey found malicious email (26%) and phishing (24%) were the two most common root causes of ransomware attacks.
Which layer stops which step?
| Layer | What it stops | Example |
|---|---|---|
| Email security | Phishing emails and malicious attachments before delivery | Microsoft 365 email protection |
| Web and DNS filtering | Clicks to known phishing and malware sites, newly registered domains | FortiGate UTP bundle |
| IPS, antivirus and sandbox | Malicious downloads and exploit attempts crossing the network | FortiGate ATP, UTP or Enterprise bundle |
| Endpoint detection and response | Malicious commands and processes on the PC itself | Microsoft Defender for Endpoint |
| Multi-factor authentication | Use of stolen passwords (phishing-resistant MFA is strongest) | Microsoft 365, FortiGate VPN with MFA |
| Segmentation | Spread from one PC to servers, CCTV and backups | VLANs on FortiGate and FortiSwitch |
| Isolated, tested backups | Permanent data loss after encryption | A NAS or cloud backup kept off the main network |
| Incident plan | Panic and delay once something happens | Contacts, roles and steps written down in advance |
Training reduces clicks. Layers make sure the click that still happens does not become a closure.
What about deepfakes and phone scams?
The "click" is not always an email. In March 2025 a finance director at a multinational in Singapore transferred more than US$499,000 after a Zoom call in which the company's executives were deepfakes; the Singapore Police Force and Hong Kong police later recovered the funds. The Singapore police, MAS and CSA advise staff to verify payment requests through established internal channels. No firewall stops a voice on a call, which is why payment approval rules belong in the same plan. See Could Deepfake Voices Become the Next Corporate Conference Call Scam?
How prepared are you? A quick test
- If one PC were encrypted right now, could it reach the file server and the backup?
- Is a copy of your backups offline or isolated, and when was a restore last tested? CSA's Cyber Essentials standard asks for testing at least twice a year.
- Does every email account, and every remote-access login, require MFA?
- Does your firewall's security subscription still update, and does it filter web and DNS traffic?
- Do staff know who to call, and does someone know how to reach the Cyber Resilience Centre's helpline (6890 9555)?
- If personal data is affected, do you know that a notifiable breach must be reported to the PDPC within three calendar days of assessing it?
How to keep working during an attack is covered in When Ransomware Strikes, Can Your Business Still Communicate?, and Fortinet's ransomware features in Ransomware Solutions Singapore.
Where should a small business start?
- Turn on MFA for every email account today.
- Make one backup copy that the office network cannot reach, and test a restore.
- Put a business firewall with UTP at the internet edge, with web and DNS filtering enabled.
- Install endpoint detection on every PC and laptop.
- Separate guests, CCTV and printers from staff PCs and servers with VLANs.
- Write a one-page incident plan and run a 30-minute drill.
Buying in Singapore
SourceIT supplies the layers in one place: FortiGate 50G (S$1,819.20 with 1-year UTP) and FortiGate 70G (S$2,630.40) firewalls, the FortiSwitch 108F (S$574.80) for segmentation, Microsoft Defender for Endpoint P1 (S$46 per year as listed), Synology backup systems and UPS units. Prices listed 30 Oct 2026. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Can one phishing email really take down a business? Yes. Sophos's 2026 survey found malicious email and phishing were the two most common root causes of ransomware, which can encrypt servers and backups if nothing stops it spreading.
Is AI phishing more effective? Studies suggest so. In a 2024 study, fully AI-automated spear-phishing emails achieved a 54% click rate, against 12% for generic phishing.
What does a firewall do against phishing? With web and DNS filtering, a FortiGate blocks known phishing and malware sites, and its antivirus, sandbox and IPS check downloads and exploit attempts. It works alongside email and endpoint security.
How should backups be set up against ransomware? Keep at least one copy separate and isolated from the main network, protect it with a strong passphrase, and test restoring it at least twice a year, as CSA's Cyber Essentials standard requires.
Who should a Singapore business call after a ransomware attack? The Cyber Resilience Centre's helpline on 6890 9555 for triage and advice, and your IT provider. Notifiable personal data breaches must be reported to the PDPC within three calendar days.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
