CYBERSECURITY | NEXTPOINT TECHNOLOGY
A step-by-step response guide for business owners and managers — and what NOT to do.
By Matt Hermsen, Founder — NextPoint Technology | 6 min read
It happens. No matter how much training you do, no matter how security-conscious your team is, someone eventually clicks something they shouldn’t.
A convincing email that looks like it’s from Microsoft. A fake invoice from what appears to be a vendor. A link promising a shared document from a colleague. Phishing attacks are more sophisticated than ever, and even careful employees get fooled.
The good news: clicking a phishing link doesn’t automatically mean you’ve been compromised. What happens next — in the next few minutes and hours — determines whether it becomes a minor incident or a major breach.
This guide gives you a clear, step-by-step response plan. Save it, share it with your team, and know it before you need it.
A phishing link is a malicious URL designed to do one or more of the following:
Steal credentials by taking the user to a fake login page that looks legitimate
Download malware or ransomware onto the device automatically
Capture session tokens that let attackers into accounts without needing a password
Redirect through multiple sites to obscure the final destination
The severity of what happens depends on what the link actually did. Some links are pure credential harvesting — dangerous, but containable. Others drop malware the moment the page loads. You won’t always know which one it was immediately, which is why your first move matters so much.
⚠️ Speed matters. The faster you act, the more you limit the damage. Don’t wait until the end of the day. Don’t assume it’s probably fine. Treat it as a real incident until you confirm otherwise.
Step 1: Disconnect the Device from the Network Immediately
This is the most important thing you can do in the first 60 seconds.
If the link downloaded malware, disconnecting the device from your network stops it from spreading laterally to other systems, file shares, or servers. This is called containment — and it’s the first principle of incident response for a reason.
Unplug the ethernet cable if the device is wired
Turn off Wi-Fi on the device
Do NOT turn the computer off — you may need it for forensic investigation
Do NOT try to "clean" it yourself by running a scan and continuing to use it
Why not turn it off? Powering down can destroy volatile memory (RAM) that contains evidence of what the malware was doing. Your IT team may need that data to understand the full scope of the incident.
Step 2: Report It Immediately — Don’t Wait
The employee who clicked the link should report it to their manager or IT contact the moment they realize what happened — not at the end of the day, not after trying to figure out if it was actually bad.
This is a culture issue as much as a technical one. Employees who are afraid of getting in trouble will delay reporting, and delay is what turns a manageable incident into a disaster. Make it explicitly clear in your organization that reporting immediately is the right thing to do and will not result in punishment.
⚠️ The biggest delays in incident response almost always come from employees sitting on the information because they were scared or embarrassed. Create a culture where reporting fast is rewarded, not penalized.
Step 3: Change Passwords on Any Accounts the Employee Accessed
If the phishing link led to a fake login page and the employee entered credentials, those credentials are now in the hands of the attacker. Change them immediately — and not from the potentially compromised device.
Use a different, clean device to change passwords for:
Email account — this is the highest priority
Microsoft 365 or Google Workspace account
Any line-of-business applications they logged into recently
Any accounts where they use the same password (yes, this still happens)
Banking or financial platforms if accessed from that device
Priority #1: Email. If an attacker gets into your email, they can use it to reset passwords on every other account, impersonate you to clients and vendors, and set up forwarding rules to monitor your inbox without you knowing.
Step 4: Revoke Active Sessions
Changing a password is not always enough. If the attacker already has an active session token — meaning they’re already logged into the account — changing the password alone won’t kick them out.
In Microsoft 365, an admin can revoke all active sessions for a user through the Entra admin portal. This forces a sign-out on every device and session simultaneously, including any the attacker may have established.
Your IT provider or admin should do this for any account that may have been compromised — not just the account where the password was changed.
Step 5: Check for Forwarding Rules and Unauthorized Access
One of the first things attackers do after gaining access to an email account is set up hidden inbox rules. These rules can:
Forward copies of every email to an external address
Automatically delete emails from specific senders — like security alerts from Microsoft
Move emails to obscure folders so the account owner never sees them
Mark emails as read so unusual activity goes unnoticed
Your IT team should audit the affected account’s inbox rules, mail forwarding settings, OAuth app permissions, and sign-in logs immediately. This is where business email compromise (BEC) attacks hide — and they can go undetected for weeks or months if nobody checks.
⚠️ Check the sent folder too. Attackers often send emails from compromised accounts to the victim’s contacts — to spread the phishing attack further or to initiate fraud. If anything was sent without the employee’s knowledge, you need to notify those recipients immediately.
Step 6: Investigate the Device
Once the device is isolated and the account is secured, your IT team needs to assess the device itself. This means:
Running a full endpoint scan with your EDR tool — not just standard antivirus
Reviewing process logs to identify anything unusual that ran after the link was clicked
Checking for newly installed software, scheduled tasks, or persistence mechanisms
Determining whether any files were accessed, exfiltrated, or encrypted
If your business uses an Endpoint Detection and Response (EDR) platform, this investigation is significantly faster and more thorough than relying on traditional antivirus. EDR tools log process activity in detail, which gives your IT team a clear picture of exactly what happened on the device after the click.
If the device is confirmed clean, it can be returned to service. If malware is found, it should be wiped and reimaged — not cleaned and trusted.
Step 7: Notify the Right People
Depending on what was compromised, you may have notification obligations beyond your internal team:
Cyber insurance carrier — notify them early, even if you’re not sure of the scope. Most policies have reporting windows and late notification can affect coverage.
Clients or vendors — if the compromised account communicated with external parties and there’s any chance those communications were intercepted or spoofed, they need to know.
Your bank — if financial accounts or wire transfer processes were potentially exposed.
Legal counsel — if customer data may have been accessed, depending on your industry and state, you may have breach notification requirements.
Notification is not an admission of guilt. It’s the responsible thing to do — and in many cases, it’s legally required.
Just as important as the steps above is knowing what to avoid:
❌ Don’t ignore it and hope for the best. “I think it was probably fine” is not a security strategy.
❌ Don’t just run an antivirus scan and call it clean. Standard antivirus misses a significant percentage of modern threats. If malware got in, you need EDR-level investigation.
❌ Don’t continue using the device on the network while you investigate. Every minute it’s connected is a minute it can spread.
❌ Don’t change passwords from the potentially compromised device. Use a clean machine.
❌ Don’t delay notifying your IT team or provider because you’re not sure if it was serious. Let them make that determination.
Phishing is the number one initial attack vector for small business breaches — not because employees are careless, but because attackers are good at what they do.
Modern phishing emails:
Impersonate trusted brands with near-perfect accuracy
Spoof email addresses so they appear to come from legitimate senders
Use urgency and fear to short-circuit careful thinking
Are increasingly personalized using information from LinkedIn, company websites, and social media
Training helps — but training alone is not enough. The businesses that weather phishing attacks best are the ones that combine employee awareness with technical controls: MFA on every account, EDR on every device, monitored inboxes, and a clear incident response process that employees actually know about.
A phishing click doesn’t have to become a breach. The difference between a minor incident and a major one is almost always how fast the right people responded and how well the environment was set up to contain it.
# | Action | Done |
1 | Disconnect device from network (ethernet + Wi-Fi) — do NOT power off | ☐ |
2 | Report to IT team or managed IT provider immediately | ☐ |
3 | Change passwords for email and all recently accessed accounts — from a clean device | ☐ |
4 | IT admin revokes all active sessions for the affected user account | ☐ |
5 | Audit inbox rules, mail forwarding, and OAuth app permissions | ☐ |
6 | Check sent folder for unauthorized outbound emails | ☐ |
7 | IT team runs full EDR scan and investigates the device | ☐ |
8 | Determine scope — what data or accounts were potentially accessed | ☐ |
9 | Notify cyber insurance carrier | ☐ |
10 | Notify affected clients, vendors, or partners if warranted | ☐ |
11 | Document the incident — timeline, actions taken, findings | ☐ |
12 | Follow up with targeted security awareness training for the team | ☐ |
Print this checklist and post it somewhere your team can find it. The middle of an incident is not the time to be figuring out what to do next.
Does Your Team Know What to Do Right Now?
If the honest answer is “not really,” that’s worth addressing before you need it. NextPoint Technology offers a free 30-minute IT assessment that includes a review of your current security posture, incident response readiness, and the controls that would limit the damage from a phishing attack.
Dubuque area and nationwide. No pressure, no obligation.
NextPoint Technology · Dubuque, Iowa · www.nextpointtechnology.com
Let's talk about how NextPoint Technology can help simplify IT for your business.