Email Security and Account Compromise
Understand the Situation
Email account compromise can range from a single suspicious sign-in to a full account takeover. Understanding what has been observed helps prioritise the response.
1
What has been observed or reported?
2
Which email platform is involved?
3
Does the account have MFA enabled?
4
How many accounts are affected, and what has been observed?
5
If a phishing or suspicious email was received — what did the user do?
6
Has suspicious activity continued after a password reset?
7
Have any suspicious inbox rules or forwarding settings been found?
Answer all questions to continue to the Test stage.