Roadmaps Security roadmaps IT security and infrastructure
Stop phishing, business email compromise and account takeover across email and collaboration tools such as Microsoft 365, Teams and Slack.
Estimated time: 12–23 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
SMTP was built to trust the sender. Learn the path a message takes, what a header reveals, and why spoofing is so easy without extra controls.
SPF lists which servers may send mail for your domain. It is the first of three records that together stop most spoofing.
DKIM signs messages so the receiver can check they were not changed and really came from your domain.
DMARC ties SPF and DKIM to the visible From address and tells receivers what to do with fakes. Reports show who is sending as you.
Learn the families: credential phishing, malware delivery, business email compromise and invoice fraud. Each needs a different defence.
Headers show the real path, the authentication results and often the real sender. Learn to read them to investigate a reported message.
Gateways filter spam, malware and phishing before delivery. Learn what the built-in protection in Microsoft 365 and Google Workspace can do.
Impersonation protection, safe links, attachment sandboxing and external-sender banners each stop part of the problem. Turn them on and tune them.
BEC uses no malware, just a convincing message. Defend with authentication, impersonation rules, payment verification processes and alert training.
Make reporting a suspicious email one click, then triage reports quickly. Users are a sensor the filters do not have.
When a phish gets through: find everyone who received it, remove it, check who clicked or entered credentials, and reset what is needed.
Train people on the threats they actually see, and run fair phishing simulations that teach rather than punish.
Beyond email: conditional access, OAuth app consent, mailbox rules, sharing settings and audit logging. Attackers love mailbox rules and rogue app consents.
The equivalent controls in Google Workspace: authentication, OAuth app control, sharing, alert centre and audit logs.
Chat tools carry files, links and external guests. Control external access, app installs and data sharing, and watch for phishing inside chat.
Attackers trick users into granting a malicious app access to their mailbox. Control which apps can be consented to, and watch for risky grants.
Send mailbox, sign-in and sharing logs to the SOC and detect mailbox rules, mass downloads, impossible travel and new OAuth grants.
Stop sensitive data leaving through email and chat with data loss prevention rules, tuned to avoid blocking normal work.
Decide the controls, the acceptable friction and the response process for email and every collaboration channel the organisation uses.
Measure and reduce how often people fall for attacks over time, with training, process and making the safe action the easy one.
Track DMARC enforcement, phish that reach inboxes, report rates and account takeovers. Report trends, not raw blocked counts.
Email is still how most attacks start: a phishing link, a fake invoice, a request from the boss that is not really the boss. Collaboration tools such as Teams and Slack have become targets too, as more work and sensitive data move into them.
This roadmap covers the whole picture: email authentication (SPF, DKIM, DMARC), gateways and filtering, phishing defence and user training, and securing the cloud collaboration suites people live in. Much of it is defensive configuration plus detection and response for what gets through.
Phishing and business email compromise cause enormous losses every year, and they land on email and chat. Every organisation needs people who can lock these channels down and respond when something slips past.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact