Notifications
Clear all
Topic starter
02/08/2026 9:45 am
TL;DR: Phishing investigation is a five-step SOC workflow that validates a report, collects evidence, scopes recipient interaction, and contains compromise, while Verizon reports the human element in 62% of breaches and the FBI IC3 ranks phishing and spoofing as the top complaint category. The operational gap is not message delivery, but consistent scoping of interaction and second-order access after a click.
NHIMG editorial — based on content published by Prophet: Phishing Investigation, A Practical Guide for SOC Analysts
Questions worth separating out
Q: What should security teams do when a phishing report includes a click or credential entry?
A: Treat the case as an identity incident, not just a mail event.
Q: Why do phishing investigations need to look beyond the original email?
A: Because the email is often only the entry point.
Q: How can SOC teams tell whether a phishing report is low impact or an incident?
A: Use interaction and identity telemetry.
Practitioner guidance
- Define interaction thresholds for escalation Classify cases by received, opened, clicked, credential-entered, and delegated-access states so analysts know when a phishing report becomes an identity incident.
- Expand scoping beyond the inbox Require reviewers to check sign-in logs, inbox-rule changes, OAuth grants, and outbound mail activity for every interacting recipient.
- Preserve evidence before containment Capture the original message, headers, URLs, attachment hashes, and sandbox results before quarantine or purge actions remove artefacts needed for audit and detection tuning.
What's in the full article
Prophet's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step phishing triage workflow for SOC analysts, including confirmation, scoping, containment, and remediation decisions.
- Evidence handling detail for headers, authentication results, URLs, attachments, and recipient interaction records.
- Operational examples of inbox-rule review, OAuth grant inspection, and outbound mail checks after suspected compromise.
- Guidance on when to automate playbook execution with SOAR or AI-assisted investigation systems.
👉 Read Prophet's guide to phishing investigation for SOC analysts →
Phishing investigation workflows: where SOC teams need to tighten up?
Explore further
02/08/2026 12:38 pm
Phishing investigation is now an identity control problem, not just a messaging workflow. The article correctly shows that the boundary of the incident is interaction, not delivery. Once a user enters credentials or grants access, the SOC is dealing with account abuse, delegated access, and session risk. That makes phishing response part of IAM and PAM-adjacent governance, not a mailbox cleanup exercise. Practitioners should treat every confirmed interaction as an identity event with containment requirements.
A question worth separating out:
Q: Which accountability model should organisations use for phishing response?
A: Phishing response should be jointly owned by SOC, IAM, and mailbox administration, because the problem crosses detection, authentication, and access control. SOC can validate the lure, but IAM owns session revocation and credential recovery, while messaging teams manage purge and blocking actions. Clear ownership prevents response gaps.
👉 Read our full editorial: Phishing investigations now hinge on interaction, not delivery
