Walk the first hour of a suspected account takeover

The alert Impossible travel fired on a support admin. Minutes later, a new OAuth consent grant appeared for an unfamiliar third-party app. The engineer is on vacation and the account can impersonate customers. This is a resource-rich identity. Small delays keep high-blast-radius actions open. The principle Contain narrowly, then widen only if evidence demands it Treat the identity and its reachable resources as the unit of risk. Preserve enough evidence to know what happened, but do not leave privileged sessions alive while you collect perfect certainty. Bad reflex Disable everything instantly and lose the trail. You shrink risk without turning…

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in