Containment steps
Move quickly after a phishing click, password entry, fake invoice, or suspicious download.
Defensive incident response guidance
AI Incident Response Assistant for Phishing, Account Compromise & Scam Events
Create practical first 15 minutes, next 24 hours, evidence collection, notification, recovery, and escalation steps after suspicious cyber events.
Benefits
Evidence checklist
Preserve messages, timestamps, screenshots, and account activity.
Escalation guidance
Know when to contact banks, IT support, platform providers, or professional response teams.
Response rhythm
Prioritise the actions that reduce harm first.
First 15 minutes
Stop interacting, secure the affected account or device, and preserve the original evidence.
Next 24 hours
Review sessions, enable MFA, contact relevant providers, and document what happened.
Escalate early
Bring in workplace IT, your bank, or qualified response professionals when access or money is involved.
FAQ
Does this replace professional incident response?
No. It provides defensive guidance only. Serious incidents should be escalated to qualified professionals.
What if money or credentials were involved?
Treat the incident as higher risk, secure affected accounts, preserve evidence, and notify relevant providers quickly.