Incident response: make the first hour count

The first hour of a suspected compromise is not a race to click every emergency button. It is a sequence of decisions: what is happening, what needs protecting and which actions reduce harm without destroying the evidence.

This checklist is a starting point for a suspected account compromise, not a substitute for your organization's incident plan or specialist assistance.

Establish ownership and a reliable channel

Name an incident lead, a technical responder and a person responsible for recording decisions. Move coordination to a trusted channel if company email or chat may be compromised. Record the discovery time, affected identities and systems, and what is known versus suspected.

Avoid sharing credentials, access tokens or sensitive customer records in the incident channel. Restrict evidence access to the responders who need it.

Preserve evidence while limiting harm

Export relevant sign-in, audit and endpoint records to protected storage. Record the query range and timezone, preserve original exports and document who collected them. Capture active sessions, recent permission changes, OAuth grants and newly created credentials where feasible.

Do not delay urgent containment solely to complete collection when an attacker is actively causing harm. Record what you changed and why. Avoid wiping devices or deleting suspicious files before a responder has assessed the evidence.

Contain the access paths, not just the password

• Revoke active sessions and investigate refresh tokens; a password reset alone may leave existing access intact.
• Review MFA enrollment and remove unauthorized factors through your approved recovery process.
• Revoke malicious app grants and examine service accounts or API keys created during the suspected compromise.
• Limit endpoint access when there is evidence of device compromise, accounting for operational impact.
• Get the right approval. Confirm the approver and backup for disruptive actions. Session revocation may be low-impact, but it cannot restore an attacker's already completed actions.

Recover with checks, then learn

Restore access only after the entry point is addressed. Verify that logging is working, access is appropriately scoped and suspicious activity has stopped. Monitor for recurrence rather than treating a successful password reset as closure.

Have legal and privacy advisers assess contractual or regulatory notification duties; deadlines depend on jurisdiction and circumstances. Finish with a timeline, lessons learned and named owners for corrective actions.

BlackPing keeps the human decision central to containment. Rehearse your approval path before an incident so evidence can become a deliberate action instead of an improvised one.

Further reading

NIST SP 800-61 Revision 3 (csrc.nist.gov) places incident response within ongoing cybersecurity risk management. CISA's incident response playbooks (cisa.gov) provide structured procedures you can adapt to your own environment.