Who should own response when an email attack turns into account compromise?

Why This Matters for Security Teams

An email attack is rarely just an email problem once credentials are entered or a session is stolen. At that point, the incident crosses messaging, identity, and endpoint boundaries, and the real risk becomes account takeover, mailbox rule abuse, token theft, and lateral movement. That is why ownership cannot stop at the mail gateway. NHI Management Group’s The 52 NHI breaches Report shows how quickly compromised identities become an enterprise-wide control failure, especially when response is fragmented.

The question is not whether multiple teams contribute. They do. The question is which function has authority to coordinate containment, user recovery, and hardening across identity, messaging, and endpoint controls. Current guidance suggests that shared execution with explicit accountability reduces delay, but there is no universal standard for this yet. In practice, many security teams discover the ownership gap only after the attacker has already persisted through mailbox rules, refresh tokens, or delegated access rather than through a planned exercise.

How It Works in Practice

The cleanest operating model is to assign a single incident owner, often the identity or security operations function, while preserving task ownership for the email, IAM, and endpoint teams. That lead must be able to declare containment actions, trigger password resets or token revocation, disable risky inbox forwarding, and decide when the account can be restored. Messaging teams usually handle mail hygiene, transport-level blocking, and inbox rule review. Identity teams handle session termination, MFA re-registration, and risk-based sign-in controls. Endpoint teams verify whether the compromise began with malware, a browser session theft, or a device-side credential capture.

Execution usually starts with evidence collection, then containment, then recovery. A practical sequence includes:

• Quarantine the malicious message and search for delivery to similar recipients.
• Revoke active sessions, refresh tokens, and app passwords where applicable.
• Reset credentials and require step-up verification before access is restored.
• Review mailbox forwarding, delegated access, OAuth grants, and inbox rules.
• Check endpoints for persistence, keylogging, or browser session reuse.

This is where email compromise becomes an identity issue, not just a messaging issue. The adversary often uses the mailbox as a trusted launch point for internal phishing, payment redirection, or access to sensitive systems. External reporting from CISA’s cyber threat advisories and NHI Management Group’s Top 10 NHI Issues both reinforce a simple point: once identity trust is broken, the response must extend beyond the inbox. These controls tend to break down when account recovery depends on manual coordination across separate ticket queues because containment and re-entry decisions drift out of sync.

Common Variations and Edge Cases

Tighter central ownership often increases coordination overhead, requiring organisations to balance faster containment against local team autonomy. That tradeoff matters most when the compromise is ambiguous, such as a user clicking a phish without credential entry, a session hijack with no password change, or a high-value executive mailbox with unusual delegation history.

Best practice is evolving for cases where identity compromise intersects with third-party email platforms, federated login, or privileged accounts. In those environments, response may need coordination with vendor support, legal, and business owners before restoration can happen. The presence of conditional access, phishing-resistant MFA, and mailbox auditing also changes who can safely make the final call. If the organisation relies on shared mailboxes, service accounts, or automation tied to the same identity plane, the response owner must also understand downstream business impact, not just technical containment.

The practical rule is simple: one function should own the incident timeline and final recovery decision, even if several teams execute the work. Without that, compromise handling becomes a relay race with no finish line, especially when the attacker still has a live session or a hidden inbox rule. Guidance from the Ultimate Guide to NHIs and the MITRE ATLAS adversarial AI threat matrix both point to the same operational reality: identity-driven abuse persists when response authority is diffuse.

Related resources from NHI Mgmt Group

• How should security teams handle email account takeover as an identity incident?
• How can organisations reduce the identity impact of email compromise?
• How should organisations reduce business email compromise risk when attackers use generative AI?
• How should security teams handle email compromise as an identity risk?