Phishing incident runbook + user comms templates

Verizon DBIR 2025: phishing was the initial access vector in 41% of confirmed SME breaches in EMEA. Median time from click to credential harvesting: 21 minutes. Median time from harvest to first malicious login from another country: 90 minutes. Your runbook needs to fit inside that 90-minute window.

• Average SME experiences 11 phishing incidents per year
• Business Email Compromise (BEC) losses average €68,000 per incident
• AI-generated phishing now bypasses 38% of legacy email filters
• Most phishing succeeds against trained users — training alone is not enough

When a user reports a suspicious email, you have 15 minutes to determine whether this is a single user issue or a campaign in progress.

• Confirm the email exists and capture full headers (do not just rely on screenshots)
• Search M365/Google Workspace for same sender/subject/URL across all mailboxes
• Check whether the user clicked the link and/or entered credentials
• Check sign-in logs for the user — any logins from new locations/IPs/agents in last 6h
• Pull URL through urlscan.io and VirusTotal — capture verdict for incident record

Containment depends on what the user did. If they entered credentials, you are racing the attacker.

• Force password reset and revoke all active sessions for affected user
• Re-enrol MFA from scratch (assume MFA fatigue or token theft)
• Block sender domain at email gateway and Defender for O365
• Quarantine all instances of the message in all affected mailboxes
• If link was clicked: isolate the device, run EDR scan, check for persistence
• If credentials entered: review and revoke any OAuth grants the user authorised

Communication is risk management. Done well it builds trust; done badly it triggers regulatory scrutiny and reputational damage.

• User comms — non-blame "we received your report, here's what happens next"
• All-staff comms — if it was a campaign: warning + screenshot of the email + reporting reminder
• Customer comms — only if their data was potentially affected; coordinate with DPO and counsel
• Regulator comms — if personal data exposure is likely, GDPR Art.33 clock has started
• Board comms — for any incident involving privileged accounts or BEC attempts

A phishing incident without a documented retrospective is a future repeat incident. The retrospective is mandatory under ISO 27001 control A.5.27 and supports NIS2 Article 21(2)(b).

• Root cause: how did this email reach the inbox? (gateway gap, allowlist, AI generation)
• Detection gap: how long between delivery and detection? Why?
• Process gap: did the user know how to report? Was reporting easy?
• Technical fix: gateway rule, allowlist removal, MFA hardening, conditional access
• Documentation: incident record, timeline, evidence, sign-off