The attacker’s tools may be new; your affected systems may not be
A business with an older line-of-business application, shared file servers and a remote-access gateway can be targeted by AI-assisted social engineering. A convincing message may lead to the same familiar consequences: stolen credentials, remote access, data theft or malware on a workstation. Response must follow those consequences across the real environment.
Do not begin by assuming every endpoint has EDR, every identity is centralised or every log has been retained. Ask which systems are supported, who administers them and which records actually exist. A response plan built around unavailable telemetry creates delay rather than clarity.
Map dependencies before broad containment changes
Identify critical applications, directory services, virtualisation, backup management and remote access. Record service accounts and integrations that could be affected by an account or network change. Older systems may rely on a shared identity whose removal stops several business processes at once.
The need to understand dependencies does not mean waiting while damage continues. The incident owner should choose a containment action using the evidence and operational constraints available. Document why it was selected, who approved it and what continuity arrangements are needed. Use a trusted communication route when normal email or remote administration may be exposed.
Work with available evidence and name the gaps
| System | Useful starting point |
|---|---|
| Windows endpoints and servers | Available security, system and endpoint records |
| Active Directory | Account and privilege changes, relevant authentication evidence |
| VPN and remote access | Sessions, account use and administrative changes |
| Firewall and network devices | Available connections, alerts and configuration history |
| Backup and virtualisation | Administrative access, changes and recovery-point integrity |
Preserve original records and their time settings. Retention may be short, and clocks may differ across devices. Correlation needs those limitations to remain visible. If a machine must be rebuilt, coordinate the evidence decision first where circumstances allow; rebuilding can remove information needed to understand the wider intrusion.
Treat hybrid identity as more than two separate checklists
A company using Microsoft 365 alongside an on-premises directory needs a coordinated identity response. Establish the authoritative identity source, synchronisation dependencies and applications that maintain their own sessions. Confirm changes in each relevant environment rather than assume a cloud action fully contains local access, or vice versa.
Microsoft’s access-revocation documentation explicitly discusses hybrid environments and application session behaviour. Use it with the actual tenant and application configuration. The response owner should record which access was removed, which remained under investigation and how effectiveness was checked.
Restore the business on a defensible basis
Recovery needs more than a machine that boots. Establish a trusted recovery source, the credentials and administrative access needed to restore it, and the conditions for reconnecting it. Confirm that the path used in the incident has been addressed and that dependent services work as intended.
AI assistance may help an analyst organise disparate records, but it cannot reconstruct logs that were never collected or prove that a backup is clean by summarising its filename. Keep decisions grounded in observable evidence. Our ransomware response guide expands the recovery planning questions.
Get help with the affected business systems
Explore this response workstream or our AI incident response services. You do not need to operate an AI application or prove the attacker used AI to request help. Describe the affected systems, observed impact and urgency; we confirm availability and agree an authorised scope.
Send only non-sensitive context through the website. If company email may be compromised, use a trusted communication channel and avoid sharing the investigation through the suspected account.
Sources and review
Reviewed 24 October 2026. The decision tables and planning examples are Atlant Security guidance. A suspected use of AI is not established attribution. Scope, availability and evidence handling are agreed before an engagement.
