What should security teams do first when a malicious email is discovered late?

Why the first move is containment, not cleanup

The first task is to stop the email from causing more harm. That means containing the message in mail systems, then confirming whether it was merely delivered or whether someone clicked it, opened a payload, or entered credentials. Late discovery changes the priority from blocking delivery to limiting spread and exposure across inboxes, endpoints, and accounts.

Containment should be broad enough to cover the original message and any close variants. Quarantine at the gateway or tenant level, block sender and domain indicators where they are reliable, and remove related messages from other mailboxes where your tooling supports it. If the message was part of a wider campaign, treat the original email as one indicator among several, not the only artifact.

What to check once delivery is confirmed

After containment, the key question is whether the message had an interactive effect. If a user clicked a link, the issue may be credential theft, token theft, or follow-on web compromise. If they opened an attachment, the issue may extend to endpoint execution, malware staging, or second-stage payload delivery. If credentials were entered, reset or disable affected accounts and assume the attacker may try to reuse sessions or mailbox access before the password change takes effect.

Preserve message headers, message IDs, URL indicators, attachment hashes, mailbox audit logs, and any endpoint telemetry tied to the recipient. Those records are what let incident responders reconstruct the timeline, match the message across mailboxes, and determine whether the event stayed as a phishing attempt or became a compromise path.

How to reduce repeat exposure after the first response

Use the initial incident to tighten the control path that failed. Mail filtering should be updated with the specific sender, domain, URL, and attachment indicators that were observed, and the mailbox policy should be reviewed for any gaps that allowed the message through. If the same lure could still reach other users, containment is incomplete even if one mailbox has been cleaned up.

Late discovery also means you should verify whether the message triggered any trust decisions beyond the inbox. That includes delegated mailbox access, forwarding rules, newly created inbox rules, or other persistence mechanisms that could keep the attacker present after the email itself is removed.

Risk and Threat Considerations

A malicious email discovered late is risky because the visible message is often only the entry point. By the time it is found, the real exposure may already be in credentials, sessions, mailbox rules, or an endpoint payload, so the response has to assume that the email may have already altered the account or the device state.

Failure mechanism: The attacker benefits from delayed detection because users may have already clicked, authenticated, or launched a payload before containment begins. That creates a narrow window where the original message can be removed while the compromise path remains active through stolen credentials, mailbox persistence, or secondary malware activity.

Impact: The likely outcome is broader exposure than the inbox event suggests, including account takeover, internal phishing from a trusted mailbox, lateral spread through contacts, and loss of forensic evidence if headers and logs are not preserved early.

Practitioner Guidance

What to verify: Confirm whether the message was merely received, actively interacted with, or used to authenticate to another service. That distinction drives whether containment ends at mail hygiene or must expand into account recovery and endpoint response.

Decision rule: If the user entered credentials, treat the account as potentially compromised until you have rotated access, reviewed active sessions, and checked for mailbox-rule or forwarding persistence. If only delivery occurred, focus on enterprise-wide quarantine, indicator blocking, and hunt for matching messages.

Practitioner takeaway: The fastest safe response is to contain the message first, then prove whether it became an access event. Do not let cleanup of the email itself substitute for checking account, session, and endpoint impact.

Related resources from NHI Mgmt Group

• What should security teams do first when a malicious file is discovered on an endpoint but the immediate process has already been blocked?
• What should security teams do in the first 24 to 72 hours after a malicious package advisory?
• How should security teams detect email attacks that look legitimate at first glance?
• What should security teams prioritise first in email posture and identity governance?