Business Email Compromise Investigations
Investigate suspicious mailbox access, fraudulent payment instructions and compromised Microsoft 365 accounts.
How we can help
What we investigate
We examine reported account compromise, suspicious sign-ins, mailbox forwarding rules, delegated permissions, malicious inbox rules and relevant audit events. We help establish a defensible timeline and identify what can and cannot be concluded from the available logs.
Immediate response
Preserve available evidence before changing settings where practical. Revoke active sessions, reset credentials, review multifactor authentication, disable unauthorised forwarding and assess affected accounts. Coordinate urgent payment diversion concerns with the financial institution and relevant authorities.
Evidence and reporting
Document sources, timestamps, log retention limits, actions taken and indicators of compromise. Findings distinguish confirmed activity from hypotheses and recommend proportionate remediation.
Reducing repeat incidents
Review conditional access, privileged roles, authentication methods, mail-flow controls, alerting and staff reporting procedures.
Discuss your requirements
Every engagement starts with a discussion of your objectives, systems, authority and scope. Contact CredTech to arrange an assessment and agree next steps.
Frequently asked questions
Is a security review the same as a penetration test?
No. A security review looks broadly at controls and risks; a penetration test uses an agreed technical scope to test weaknesses.
Can you review a small business environment?
The scope can be tailored to the size and complexity of the organisation.
How we can help
Cybersecurity assessments, security posture reviews, remediation planning and technical advice.
A practical engagement
We start by understanding your requirements, agree on scope and deliver findings with context, limitations and clear next steps. The precise method and deliverables depend on the engagement.