Educate your staff how to recognize a phishing attempt (ie. fake email or fake website).

It’s one of the best and cheapest methods to defend your office from hacking and virus infection.