Most attacks arrive by email. Google filters a lot, but the default settings are not the strictest ones available to you.
What we actually do
- Advanced attachment and link scanning switched on
- Protection against spoofed senders (SPF, DKIM, DMARC)
- Suspicious mail quarantined instead of delivered
- Training people to spot the fraud that gets past the filter