Who should own takedown decisions when a phishing campaign spans email, ads and collaboration tools?

Who should own phishing takedown decisions across channels?

Ownership should sit with a pre-defined cross-functional response path that includes security, legal and the platform owners who can actually remove the infrastructure. The key is pre-delegated authority. If each takedown requires fresh debate, the attacker keeps moving faster than the organisation can coordinate.

Why takedown ownership must be pre-assigned

Phishing takedowns fail when ownership is treated as a one-off judgement rather than an incident workflow. Email, ads and collaboration tools each have different reporting channels, abuse processes and evidence thresholds, so the decision maker needs both authority and reach. Without that, teams lose time reconciling who can act, who must approve and who owns the external escalation.

That is why the practical owner is usually not a single team, but a named response path with a clear decision lead. Security should coordinate the incident, legal should manage any content, preservation or notice constraints, and the platform or channel owner should execute the removal request through the right vendor process.

How the decision path should work in practice

The decision should be made once, before the campaign starts, and then reused. For a live phishing event, the lead responder should be able to classify the campaign, route the case to the correct channel owner and trigger removal without waiting for an ad hoc committee. Phishing Incident Response Playbook is useful here because it anchors the sequence: triage, scoping, mailbox purge, token revocation and lessons learned.

Channel ownership matters because the controls differ by surface. Email teams can purge mailboxes and block sender patterns, ad teams can work through abuse and impersonation reporting, and collaboration owners can remove guests, apps, bots or shared-channel access. A generic "security owns it" model often stalls at the point where only the platform operator can actually enforce takedown.

For collaboration channels in particular, the owner has to understand that the issue may be chat phishing, guest abuse or OAuth-based tooling rather than email alone. Collaboration Tool Security Guide is the better reference when the campaign uses Teams, Slack or similar tools, because the removal path depends on guests, apps, bots and message-level controls, not just inbox filtering.

What good governance looks like when attackers move across channels

Cross-channel phishing is hard to contain when every platform has its own queue and its own vocabulary. A strong ownership model defines one incident lead, one escalation path and one set of pre-approved actions, while leaving execution to the platform owner with the fastest takedown ability. That reduces delay when the same lure appears in email, sponsored ads and internal collaboration spaces.

It also helps to keep the response path tied to evidence handling. The team that owns the decision should know what must be preserved before a request goes out, what content can be removed immediately, and when the case should be escalated because the campaign may already have delivered credential theft or token abuse. If the authority to remove content is not matched to the authority to preserve evidence, the organisation either moves too slowly or destroys useful investigative material.

Risk and Threat Considerations

Phishing campaigns that span multiple channels create a coordination risk as much as a content-removal risk. Attackers benefit when defenders split ownership by channel, because each delay gives the campaign more reach and more chances to harvest credentials or redirect users to fresh infrastructure.

Failure mechanism: The organisation fragments decision-making across email, advertising and collaboration teams, so takedown requests wait on serial approvals instead of a pre-delegated path. That creates a predictable lag that attackers can exploit by rotating lures, domains or placements before removal completes.

Impact: Exposure persists longer, the same lure can keep landing in new channels, and response teams may miss the window to suppress credential theft, session abuse or downstream impersonation.

Practitioner Guidance

What to prioritise: Define one incident owner for the decision and separate execution owners for each platform before the next campaign arrives. The decision owner should be able to invoke takedown, legal review and preservation steps without rebuilding authority in the middle of an incident.

What to verify: Confirm that every major delivery channel has a named operator, an abuse contact path and an agreed threshold for immediate removal versus review. If the path is not documented and exercised, treat it as an unresolved control gap rather than an operational detail.

Practitioner takeaway: Takedown ownership works best when authority is pre-delegated to a single response path, because the organisation only wins if it can remove content as fast as the attacker can reappear elsewhere.

Related resources from NHI Mgmt Group

• Guide: Phishing Guide
• Why do collaboration tools create such a large secrets risk?
• What happens when phishing is delivered through collaboration tools and SMS instead of email alone?
• Who should own protection against impersonation and trust abuse across collaboration tools, email, and file-sharing services?
• What are the signs that phishing is spreading through collaboration tools instead of email?