A quick response limits the damage when someone has clicked or replied. Remove the email from all mailboxes, block the sender and reset credentials if they were entered.
Why it matters
For Phishing, response is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Pull matching emails from all inboxes
- Reset passwords and revoke sessions
- Check for new mailbox rules
Where to start
Write a short playbook so anyone on call can follow it. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.