When a Phishing Breach Hits, Who Answers to the Board?

The message looks routine. A finance analyst opens what appears to be a signed vendor invoice, clicks a link, and enters credentials into a page that mirrors the company’s single sign-on portal. Within minutes, a threat actor has mailbox access, forwarding rules, and a foothold to launch internal phishing against payroll and treasury. By the time the security operations center notices anomalous outbound traffic, the intruder has been reading executive email for two days.

This is the operational reality behind most business email compromise events, and it is also the moment when accountability shifts. Security tooling records alerts, authentication events, and remediation actions, but the board-facing record extends further into legal analysis, committee decisions, approvals, and governance documentation. Governance solutions such as DiliTrust provide controlled environments for managing those sensitive board and legal records alongside the wider governance process.

The First Hour After a Business Email Compromise

Email breaches move faster than most runbooks assume. The FBI’s Internet Crime Complaint Center has tracked BEC losses in the billions of dollars, and the median dwell time inside a compromised mailbox is measured in days, not weeks. Speed of detection dictates almost every downstream cost, from wire recovery to notification obligations.

The first hour sets the evidentiary record. Logs pulled late, mailboxes reset before forensics, or forwarding rules deleted without capture all narrow the options later. A disciplined first response protects both the network and the paper trail an auditor will request months afterward.

Why Email Incidents Escalate Into Accountability Failures

Most email breaches are contained technically within days. The reputational and regulatory fallout takes far longer, and it usually traces back to one of three structural weaknesses.

Fragmented Ownership Across Security and Operations

Email sits between IT, security, HR, legal, and communications. When no single owner is named before an incident, each function assumes another is handling notification, evidence preservation, or customer outreach. The result is duplicated work and, worse, gaps that surface only during a post-incident review.

Evidence Gaps That Undermine Forensic Review

Cloud platforms retain different categories of evidence for different periods, so investigators need to know which records are available before an incident occurs. Microsoft 365 audit retention varies by license and workload, while Google Workspace distinguishes between longer-lived audit events and shorter-lived tools such as Email Log Search. Organizations that need longer investigative histories should map those limits in advance and preserve relevant evidence early in the response.

Communication Delays That Reach Customers Before Executives

Phishing incidents often become public because a downstream recipient reports a fraudulent wire request before the originating company confirms the breach. Executives learning about their own incident from a customer email is a governance failure, not a communications failure.

Building an Email Incident Response Playbook Your Auditors Will Accept

A defensible playbook covers detection, containment, forensics, notification, and closure, with named owners at each step. It also assumes cloud email as the default environment, meaning Microsoft 365 or Google Workspace tenant configurations sit at the center of both the attack surface and the evidence source.

1. Detect: Correlate mail flow anomalies, impossible-travel sign-ins, and MFA fatigue events.
2. Contain: Revoke sessions, disable forwarding rules, rotate credentials, and quarantine affected mailboxes.
3. Preserve: Export mailbox audit logs, message trace data, and admin activity before any remediation.
4. Notify: Engage counsel, insurer, and, where required, regulators and affected parties.
5. Close: Document root cause, control failures, and remediation with a timeline suitable for board review.

Our own field guidance on what to do when a business email account is compromised walks through the technical containment steps in more depth. A step-by-step response guide for hacked business email covers immediate recovery steps such as credential resets, session revocation, forwarding-rule checks, endpoint scanning, and notifying affected contacts. Those actions complement the governance work that begins once the organization has to document what happened and brief senior leadership.

The Governance Bridge When the Board Asks What Happened

Boards no longer accept a technical summary as a full answer. Directors want to see the decision record: who was informed, when, what options were weighed, and how the response met legal and regulatory duties. That record lives outside the security tooling stack, in the minutes of the risk committee, the memoranda from outside counsel, and the notification logs held by the corporate secretary.

The governance question is whether those artifacts hold together. Fragmented storage, informal email threads, and personal drives are the enemies of a defensible reconstruction. Regulated organizations increasingly consolidate board materials, incident memoranda, and committee minutes in a single controlled workspace so that the sequence of decisions is intact and time-stamped when a regulator asks.

Preparing the Governance Layer Before the Next Incident

The security team owns detection and containment. The board owns oversight of the response and the controls that failed. Between them sits a layer of legal, secretarial, and risk work that determines whether an incident becomes a resolved event or a multi-year enforcement matter. Preparing that layer in peacetime is cheaper than assembling it under pressure.

Three practices separate organizations that answer the board cleanly from those that improvise. First, a named incident owner with authority to convene legal, security, and communications within a single hour. Second, a preserved evidentiary chain covering both technical logs and governance decisions. Third, a standing reporting template for the risk committee so that briefings do not have to be invented mid-crisis. Public guidance from CISA on business email compromise offers a solid baseline for the technical half of this program.

What Directors Will Remember Six Months Later

Regulators, insurers, and shareholders will judge an email breach less on the intrusion itself and more on the quality of the response. Was the timeline coherent? Were the right people informed at the right moment? Did the organization act with the care its own policies described? Directors carry the answers to those questions, and they carry them long after the mailboxes are restored. The organizations that answer well are the ones that built the governance layer before they needed it.