Cybersecurity Red Flags: What Every Bristol Business Should Watch For

Most cyber attacks don’t announce themselves. There’s no dramatic warning screen or siren. Instead there are small, easy-to-miss signs in the days or weeks before something goes properly wrong. Knowing what those signs look like, in emails or on your network, is one of the simplest ways to catch a problem before it becomes a full-blown incident. Here are the red flags that matter most, and what to do when you spot one.

What are the most common cybersecurity red flags in emails?

Email is still the number one way attackers get into a business, and most of the tell-tale signs are hiding in plain sight:

• A sense of urgency. “Pay this invoice today” or “your account will be suspended in 24 hours” is a classic pressure tactic designed to stop you thinking clearly.
• A slightly wrong sender address. Look closely at the domain, not just the display name. account@three-cherries-support.co.uk is not the same as accounts@three-cherries-support.co.uk example. We also see people spelling microsoft as rnicrosoft (Using r-n instead of an m)
• A request to change bank details. Any email asking you to update payment details for a supplier or update where a wage goes should be verified by phone, using a number you already have on file, not one in the email.
• Unexpected attachments or links, especially ones asking you to “enable content” or log in again to view a document.
• Slightly off tone or phrasing from someone you know well. If a colleague’s email suddenly reads a bit stiff or oddly formal, that’s worth a second look.

If you get one of these, don’t click, don’t reply, and don’t forward it to “check with someone” over email. Call the sender directly instead.

How do you spot a compromised user account?

A hijacked account rarely looks breached from the inside. The signs tend to be quiet:

• Login alerts from unfamiliar locations or devices, especially outside normal working hours
• Sent items containing messages the user didn’t write
• Colleagues receiving strange emails “from” a particular person
• Password reset emails the user didn’t request
• Mailbox rules appearing that quietly forward or delete certain messages, a common trick used to hide fraud in progress

If any of these show up, lock the account and reset the password immediately, then check what mailbox rules and forwarding settings have been added.

What are red flags on a device or network, not just in email?

Some warning signs live outside your inbox entirely:

• A device running noticeably slower than usual, or the fan constantly working hard for no obvious reason
• Software or browser toolbars appearing that nobody installed
• Security software being switched off without anyone doing it deliberately
• Unusual spikes in data usage or network traffic, particularly overnight when nobody should be working
• Files or folders that have been renamed, encrypted, or moved without explanation

Any one of these on its own might have an easy and non-threatening explanation. Several turning up together, especially the security software being disabled, is a strong sign something is already active on the network.

What are the human red flags, not just the technical ones?

Technology isn’t the only weak point. Some of the most damaging incidents start with a phone call or a conversation:

• Someone claiming to be from IT support asking for a password or remote access out of the blue
• A “new supplier” asking to be paid before any proper checks have been done
• A caller who already seems to know internal details, like a manager’s name or a recent project, and uses that to sound legitimate
• Pressure to bypass a normal process “just this once” because someone senior is supposedly waiting on it

Genuine IT support, including us, will never ask for your password. If someone’s applying pressure to skip a step you’d normally follow, that pressure is the red flag.

What should you do when you spot a red flag?

1. Don’t act on the request. Don’t click, don’t pay and don’t share credentials.
2. Verify through a separate channel. Phone the person or company using a number you already trust, not one from the suspicious message.
3. Report it internally, even if you’re not sure it’s anything. Flagging a false alarm costs nothing. Missing a real one can cost a lot.
4. Isolate the device if you think something’s already active, disconnect it from the network rather than shutting it down, so a technician can see what happened.
5. Get your IT provider involved early. The earlier a suspected incident is looked at, the easier the clean-up tends to be.

Cybersecurity as a whole

Most cyber attacks give a warning before they cause real damage. It’s usually a slightly wrong email address, an oddly worded message, a login from nowhere near Bristol at 3am, or a caller who’s a bit too pushy. Training your team to notice and report these small signs, rather than brush past them, is one of the most cost-effective things a small business can do for its security.

If you’re not sure whether something you’ve spotted is worth worrying about, it’s always worth asking. That’s a much cheaper conversation than the one that happens after a breach.

Three Cherries provides managed IT support and cybersecurity for businesses across Bristol and the South West. Get in touch if you’d like your team’s ability to spot these red flags put to the test.