What it means
Email attack incident response addresses phishing, business email compromise, malicious attachments, impersonation, mailbox abuse, and related identity compromise.
Why it matters
The visible message may be only the entry point; responders must evaluate accounts, sessions, forwarding rules, endpoints, payments, and recipients.
Practical focus
- Preserve the message and delivery metadata
- Identify all recipients and interactions
- Secure affected identities and sessions
- Remove persistence and notify business owners
Common mistakes
- Deleting the message before preserving evidence
- Resetting a password without revoking sessions
- Checking only the first recipient
- Ignoring financial and external communications impact
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: