Cybersecurity · Phishing response
A minute-by-minute plan for owners and office managers, what the click actually exposed, and why the employee who owned up quickly just did you a favor.
Disconnect, then reset and revoke
Check mailbox rules and forwarding
Thank the person who reported it
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
If an employee has just told you they clicked a link in a suspicious email, do these things in this order: take the computer off the network, reset that person’s password from a different device, sign them out of every session, look for new mailbox rules or forwarding, run a full scan on the computer, and tell whoever runs your IT. Most of that takes less than an hour. The order matters more than the speed of any single step, because a password reset on its own leaves an attacker who already has a session logged in for a while longer.
Then, before you do anything else, thank the person who told you. I’ll come back to why.
“I clicked a link” covers everything from nothing much to a pretty big deal. Ask three quick questions, calmly, and write the answers down with the time:
If all three answers are no, the risk is low, though you should still check the device. If they typed a password, assume the account is compromised. If they typed a password and approved a phone prompt, assume the attacker is already signed in, because modern phishing kits relay the password and the MFA code to the real Microsoft or Google sign-in page in real time. If something downloaded and ran, the computer itself is the problem, not only the account.
Unplug the network cable or turn off Wi-Fi. Don’t shut the computer down if you can avoid it, since whoever investigates may want to see what’s running. If your endpoint protection has an “isolate device” button (many business EDR tools do), that is the cleaner way to do it.
Do this from a different, clean device. In Microsoft 365, an admin resets the password, then in the Microsoft Entra admin center opens the user and selects Revoke sessions. That second step matters. Microsoft’s documentation explains that access tokens last an hour by default, so an attacker who already holds one can keep working after a password change unless the sessions are revoked as well. In Google Workspace, open the user in the Admin console and go to Security, then Sign-in cookies, then Reset, which signs them out of browsers and mobile devices (Google notes it doesn’t sign them out of apps such as Gmail and Drive for desktop), and reset the password from the same page.
While you’re in there, look at the user’s registered sign-in methods. Attackers who get in sometimes add their own phone or authenticator, so the next time you lock them out they simply sign back in. Remove anything the employee doesn’t recognize.
This is the step owners don’t know about, and it’s the one that causes the damage weeks later. Open the user’s inbox rules and forwarding settings. Microsoft’s own investigation guide describes the usual tricks: rules that forward mail to an outside address, rules that delete incoming mail, and rules that quietly move messages containing words like “invoice” into a folder nobody opens (Microsoft gives the RSS folder as its example) and mark them as read. An attacker who sets that up can sit in a conversation about a wire transfer without anyone seeing the replies. Delete any rule the employee didn’t create, and switch off any forwarding to addresses you don’t know.
Then check the Sent folder for the last few hours. If the account sent phishing emails to your clients or colleagues, they need a warning from you, by phone if money is involved.
Run a full scan with your endpoint protection. Have your IT provider look at the sign-in logs for that account (unfamiliar countries, unfamiliar internet providers, sign-ins from a browser the person doesn’t use) and check whether the same sending address hit anyone else. If it did, block the sender and pull the message from other mailboxes. If the person uses the same password anywhere else, personal or work, change it there too.
Last, if there’s any chance a payment, payroll change or bank detail was involved, call your bank the same day. Speed matters far more with money than with anything else on this list.
At a client, a small engineering consultancy, an accounts employee opened a convincing Microsoft 365 document-sharing message and entered their credentials on a lookalike sign-in page. They realized something was wrong when the page simply returned to the login screen, and they told us. We treated that report as a potential credential compromise from the start, rather than as a suspicious click to keep an eye on. We blocked sign-in, reset the password, revoked active sessions, verified the MFA methods on the account, and went through the Entra sign-in logs and the Microsoft 365 audit logs. We were looking specifically for unfamiliar successful logins, new inbox forwarding rules, OAuth consent grants (apps the user has allowed into their account) and messages sent from the account.
There was a suspicious sign-in from an unfamiliar network. There was no unauthorized mailbox forwarding or outbound mail in the logs we had available. We restored access once the account was secured, preserved the evidence, and reviewed the tenant’s phishing-resistant MFA options. The employee’s quick report limited the investigation. To be honest about its limits, though, it did not by itself prove that no data was accessed.
I feel strongly about this one. The click is going to happen. Phishing emails are written by people whose whole job is getting a busy person to tap the wrong thing at 4:45 on a Friday, and no amount of training gets that number to zero. What you can change is how quickly you hear about it.
The employee who walks into your office two minutes after clicking has given you a head start of hours or days. The one who clicks, feels foolish, and says nothing is the real risk, because the attacker then has as long as they like. If people get shouted at, docked or mocked in a meeting for clicking, the lesson everyone learns is to keep quiet next time. So thank the person, fix the problem, and save your irritation for anyone who knew and didn’t say.
The exception, in one sentence: someone who keeps clicking after training and repeated reminders needs a different conversation, and I’d handle that as a performance issue, separately.
Our guide to phishing training for employees covers how to make reporting the easy, normal thing to do.
An hour is quick, but only if you already know who has admin access, where the inbox rules live and what your endpoint tool can do. Did you have to look all of that up just now? Then fix it while things are calm. Phishing-resistant MFA (passkeys or security keys) for admins and finance staff, alerts on new forwarding rules, and a written incident response plan that fits on one page will make the next one much shorter. We set these up as part of our cybersecurity service.
If you’d like to know how ready you are, our free Technology Health Assessment rates your cybersecurity along with the rest of your IT: 30 minutes of data collection, a plain-language report the next day, and a short list of next steps in order. It’s yours to keep. Pick a time that suits you.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Usually the risk is low, but not zero. Some links try to download a file or exploit an out-of-date browser. Disconnect, run a full scan, make sure the computer is fully updated and tell IT. If nothing ran and you typed nothing, that’s normally the end of it.
Do both, back to back, from a clean device. Changing the password stops new sign-ins; revoking sessions throws out anyone already signed in. Doing only the first can leave an attacker working for up to an hour or longer.
It depends on what was exposed and your industry. If client data, health records or money were involved, you may have notification duties under state law or your contracts, and your cyber insurer will want to hear early. This is general information, not legal advice, so check with your lawyer and insurer.
Not for a first click they reported quickly. In my view that is exactly the behavior you want, and punishing it teaches everyone else to stay quiet. Repeated clicks after training are a separate conversation.
