Phishing investigations now hinge on interaction, not delivery

At a glance

What this is: This is a practical guide to phishing investigation workflows, with the key finding that SOC teams have to focus on interaction and downstream exposure rather than delivery alone.

Why it matters: It matters because IAM, SOC, and incident response teams need a repeatable way to identify who interacted, what access changed, and whether attacker activity moved beyond the inbox.

Context

Phishing investigation is a SOC workflow for deciding whether a message is malicious and whether it led to compromise. The control gap is not simply whether a message arrived, but whether anyone interacted with it and whether that interaction created second-order access.

That distinction matters because delivery is only the start of the risk path. Once a user clicks, enters credentials, opens an attachment, or grants consent, the problem shifts from email filtering to identity and session governance, which is why the same workflow must cover message evidence, recipient interaction, and post-click account activity.

The article’s approach is typical of modern SOC practice, but it is broader than legacy inbox triage because it treats phishing as a case-management and identity exposure problem, not just a spam problem.

Key questions

Q: What breaks when phishing investigation stops at message delivery?

A: Teams miss the point where a reported email becomes a real incident. Delivery tells you only that the lure arrived. The risk changes when someone interacts, enters credentials, or authorises access, because then the investigation has to expand into identity, session, and mailbox governance to understand the blast radius.

Q: Why does post-click activity matter more than the original phishing email?

A: Because the email is often only the entry point. The real compromise can appear in sign-in history, inbox rules, OAuth grants, or outbound mail activity after the click. Those artifacts show whether the attacker gained persistence or moved beyond the lure into account-level control.

Q: What are the signs that a phishing investigation process is failing?

A: A failing phishing process usually shows up as long triage times, heavy portal switching, inconsistent verdicts, and backlog growth faster than analysts can clear it. Another warning sign is overreliance on reputation checks alone, which misses targeted attacks using fresh domains or URLs. If analysts cannot trace every conclusion to evidence, the process is too fragile for reliable response.

Q: How should SOC teams respond when a phishing report becomes a confirmed compromise?

A: They should preserve evidence first, then contain the message, reset affected credentials, revoke active sessions, and check for mailbox or OAuth persistence before closing the case. The response should be driven by exposure scope, not by the order in which alerts arrived.

Technical breakdown

Why phishing investigation starts with interaction, not delivery

Phishing is a delivery mechanism, not an outcome. A message may be used for credential theft, malware delivery, fraud, or reconnaissance, so analysts cannot stop at whether it reached a mailbox. The decisive question is whether the recipient interacted with the lure in a way that could create identity or access risk. That means classifying recipients by state, from received to opened to clicked to credentialed. Once interaction occurs, the investigation must shift from message handling to exposure analysis, because the control failure is no longer in email transport alone.

Practical implication: build investigation triage around interaction state, not message volume.

How SOC teams scope second-order access after a click

After interaction, the analyst has to determine whether the event extended beyond the original message. That typically means checking sign-in history, inbox rule changes, OAuth grants, and outbound mail activity to see whether the attacker obtained persistence or access expansion. These artifacts matter because a click can create a much larger compromise surface than the email itself suggests. In identity terms, the investigation is now about whether delegated access, session abuse, or mailbox manipulation occurred after the initial lure.

Practical implication: treat sign-in logs and mailbox change logs as primary evidence, not supporting detail.

Why evidence preservation and detection write-back are part of the same control

A phishing case does not end with containment. Analysts need the original message, headers, URLs, attachment hashes, and interaction records before remediation removes the evidence. They also need to feed indicators back into detection rules, because a case that is not written back into the control stack tends to recur. This creates a loop between forensics and engineering: preserve artifacts first, then remediate, then update detections and playbooks so the same lure is faster to classify next time.

Practical implication: preserve artifacts before remediation and convert each case into detection logic.

Threat narrative

Attacker objective: The attacker wants to turn a single lure into usable account access or fraudulent control over communications and identity-linked workflows.

1. Entry occurs when a phishing message reaches the recipient through email or another legitimate communication channel.
2. Credential access or compromise begins when the recipient clicks, opens, replies, or enters credentials, turning a delivered message into an incident.
3. Escalation happens when analysts find inbox rules, OAuth grants, or active sessions that extend attacker access beyond the original message.
4. Impact is the broader compromise, including account takeover, fraudulent mail activity, or downstream business email compromise.

Breaches seen in the wild

• TruffleNet stolen AWS keys campaign 2025: TruffleNet used 800+ attacker hosts to test stolen AWS keys and check SES capacity; one compromised account sent a fake $50,000 invoice.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Interaction scoping is the real control boundary in modern phishing defence: delivery filters reduce volume, but they do not answer whether a recipient created exposure by clicking, replying, or granting access. SOC teams that stop at message verdicts miss the identity and session layer where compromise actually becomes operational. The practitioner conclusion is to treat interaction state as the first governance boundary, not the inbox.

Phishing has become an identity governance problem, not just an email problem: once a user enters credentials or authorises access, the investigation has moved into session, mailbox, and OAuth governance. That is where attacker persistence often hides, especially in environments with delegated access and broad mail permissions. The practitioner conclusion is to align phishing response with identity telemetry and post-authentication review.

Second-order access is the named failure mode this workflow exposes: the message itself is rarely the end state, because inbox rules, active sessions, and token grants can survive the initial lure. This is the gap SOC teams must manage if they want to prevent a simple click from becoming durable access. The practitioner conclusion is to operationalise post-click scoping as a standard control, not an exception.

Unified phishing handling is a governance maturity signal: a team that validates, scopes, preserves evidence, and feeds detections back into engineering is managing phishing as a repeatable security process. A team that remediates first and investigates later is accepting avoidable blind spots. The practitioner conclusion is to make case handling measurable across validation, scope, containment, and write-back.

MITRE ATT&CK remains useful here because the threat is behavioural, not just procedural: the article’s workflow maps naturally to credential access and related post-delivery abuse, which is why phishing should be analysed as a chain of attacker actions rather than a single alert. The practitioner conclusion is to connect detection logic to the attack technique, not just the reported message type.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
• Read next: Email Identity and BEC Guide

What this signals

Phishing response has to shift from message handling to identity and session review, because the actionable risk begins only when interaction creates new access paths. SOC teams that can map a click to inbox rules, OAuth grants, or active sessions are closer to controlling the real blast radius.

Second-order access gap: this is the control failure where a reported message is treated as the incident, while the actual compromise sits in post-click identity changes. Practitioners should watch for mailbox persistence, delegated access, and repeatable case handling that preserves evidence before remediation.

For most security programmes, the next maturity step is integrating phishing workflows with identity telemetry so validation, scoping, and containment happen in one workflow rather than separate queues. That is the difference between counting reports and governing compromise.

For practitioners

• Classify recipients by interaction state Track whether each recipient only received, opened, clicked, replied, or entered credentials so analysts can scope exposure consistently across cases.
• Review post-click identity artifacts Check sign-in history, inbox rule changes, OAuth grants, and active sessions for any account that interacted with the lure.
• Preserve the original message before containment Capture the native message, headers, URLs, attachments, hashes, and sandbox output before purge or takedown removes evidence.
• Write indicators back into detections Turn sender infrastructure, lookalike domains, and credential-harvest URLs into updated rules so similar cases are caught without manual review.
• Prioritise by business impact, not queue order Escalate targeted payment-fraud and credential-compromise cases ahead of high-volume low-impact reports when the likely business exposure is higher.

Key takeaways

• Phishing investigation is really a workflow for deciding when delivery has turned into interaction-driven compromise, not a simple inbox triage task.
• The key evidence sits after the click, in sign-in history, inbox rules, OAuth grants, and other second-order access indicators.
• Teams reduce repeat incidents when they preserve evidence first, scope access changes quickly, and feed indicators back into detection engineering.

Key terms

• Phishing Investigation: The process of determining whether a reported message is malicious, who was exposed, whether anyone interacted, and what compromise resulted. In practice, it combines message analysis with identity and access review so the team can scope risk and contain persistence, not just remove the email.
• Second-order access: Second-order access is the identity or session activity that occurs after a user interacts with a phishing lure. It includes inbox rule changes, OAuth grants, active session abuse, and other follow-on actions that can turn a single click into persistent attacker control.
• Interaction state: Interaction state describes what a recipient did with a suspicious message, such as receiving, opening, clicking, replying, or entering credentials. It is a practical investigation concept because the security response changes materially once a user has interacted with the lure.
• Evidence write-back: Evidence write-back is the practice of feeding indicators and case findings from an investigation back into detection engineering. It turns a one-off response into a reusable control by updating rules, playbooks, and triage logic so similar attacks are caught earlier next time.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management in a way that helps security practitioners connect identity controls to real operational risk. It is designed for teams that need to govern access, review exposure, and tighten lifecycle controls across modern security programmes.