← Back to the guide

Business Email Compromise response playbook

6slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M

solvingmicrosoft365.com

1 / 6

Business Email Compromise response playbook

How to respond to a confirmed BEC incident in Microsoft 365 — containment, investigation, remediation, and prevention.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/bec-response-playbook

Slide 1Download PNG

M

solvingmicrosoft365.com

2 / 6

01

Containment (first 30 minutes)

If you have Defender XDR Automatic Attack Disruption enabled, much of this happens automatically.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/bec-response-playbook

Slide 2Download PNG

M

solvingmicrosoft365.com

3 / 6

02

Investigation (first 24 hours)

Establish scope:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/bec-response-playbook

Slide 3Download PNG

M

solvingmicrosoft365.com

4 / 6

03

Remediation

Once contained and investigated:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/bec-response-playbook

Slide 4Download PNG

M

solvingmicrosoft365.com

5 / 6

04

Prevention

After the incident, harden against the next one:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/bec-response-playbook

Slide 5Download PNG

M

solvingmicrosoft365.com

6 / 6

05

Lessons

BEC incidents are rarely "we couldn't have prevented this." They're usually "we had the tools but hadn't enabled them yet." Post-incident, the most valuable thing is a realistic gap analysis — what would have prevented…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/bec-response-playbook

Slide 6Download PNG

Auto-generated from Business Email Compromise response playbook. This page is not indexed and isn't part of the guide itself.