Interaction state

What interaction state tells investigators

Interaction state turns a suspicious message into an evidential timeline. It helps investigators distinguish passive delivery from active engagement, which changes both the likelihood of compromise and the urgency of containment.

At the simplest level, “received” means the lure reached a mailbox or inbox, while “opened” shows the content was rendered. “Clicked,” “replied,” and “entered credentials” each represent progressively stronger signs that the user moved from exposure to interaction, and possibly to credential capture or session compromise.

Why interaction state matters in triage

Interaction state is useful because not every suspicious message deserves the same response. A message that was only received may call for monitoring and user education, while a clicked link or submitted credential can justify containment, credential reset, token revocation, and broader hunting.

This distinction prevents overreacting to harmless delivery events and underreacting to confirmed engagement. It also gives incident responders a common language for deciding whether the event is merely suspected phishing, likely phishing, or an active compromise path.

How interaction state is used in phishing and abuse analysis

Security teams use interaction state to correlate user behavior with technical telemetry such as email gateway logs, proxy logs, identity logs, and endpoint events. That correlation helps confirm whether a suspicious lure actually led to web access, credential submission, malware delivery, or downstream account abuse.

It also supports better pattern analysis across campaigns. For example, the same lure can produce very different outcomes across users, and the interaction state shows whether a campaign is simply high volume or genuinely successful at driving compromise.

Because interaction state describes what happened after delivery, it is often the bridge between awareness reporting and incident handling. CISA cyber threat advisories can provide useful context when the interaction pattern matches a known phishing or credential theft campaign.

Common pitfalls in interpreting interaction state

Teams sometimes treat “opened” as if it always means compromise, but that is too strong a conclusion on its own. Opening a message confirms exposure, not necessarily malicious execution or data loss.

The opposite mistake is to treat “clicked” as a minor event when the link led to a credential prompt, consent flow, or session replay page. In practice, the meaning of the state depends on what the user encountered next and whether any secret material was entered or any trust boundary was crossed.

Risk and Threat Considerations

Interaction state matters because each step in the user journey can change the attacker’s opportunity. A lure that is merely delivered creates limited exposure, but a click, reply, or credential entry can enable account takeover, malware delivery, or follow-on social engineering.

Failure mechanism: Attackers rely on interaction state to separate noisy delivery from successful engagement. Once a user interacts, the attacker may gain a trusted reply channel, a harvested credential, or a foothold for later abuse.

Impact: The organization may need to escalate from message review to identity response, endpoint investigation, and campaign containment. In higher-severity cases, interaction state can be the difference between an attempted phish and a confirmed compromise path.

Practitioner Guidance

Why practitioners should care: Use interaction state as an investigation field, not just a reporting label. It helps responders choose the right next action and avoids treating all suspicious messages as equivalent.

Common misunderstanding: Do not collapse all engagement into a single “clicked” bucket. Replying, opening, and entering credentials have different response implications, and the most serious state should drive the operational response.

Practitioner takeaway: The most useful interaction state is the one that can be defended by evidence from mail, proxy, endpoint, and identity logs.

Related resources from NHI Mgmt Group

• What are the different Agentic AI interaction patterns and their NHI implications?
• What challenges arise from the interaction between AI and NHIs?
• When should organisations require user interaction instead of autonomous agent action?
• Who is accountable when an AI agent exposes credentials or changes identity state?