Talking to people during triage

About 13 min read

On this page

E Companion

Most of triage is queries, but some answers only a person can give. Every conversation is evidence collection, and an action the adversary may be able to see. This page covers who to ask, on which channel, in what words, and when to say nothing at all.

Analysts talk to people in almost every phase: the user in Subject, a data owner and finance in Scope, a change approver in Uncover, IR, managers, and compliance at the Escalation decision. Each contact can settle a hypothesis, warn an attacker, or put a sentence into the record that a regulator or opposing counsel reads later. Three rules hold throughout:

---

Verifying with the user

The user is often the fastest discriminator in an account-takeover case. In Case C, one phone call at 09:19 UTC established that rvega was at her desk on her laptop, used no VPN, created no inbox rule, approved no application, and remembered a push prompt right after opening a shared-document link. Together with two independent log sources, that call took the case to High confidence and tripped the escalation tripwire at 09:22 (see the Alert example). It worked because only rvega could separate “rvega did this” from “someone using her session did this”.

When not to ask

Ask the user when their answer can change the decision and the asking cannot hurt the case. Do not ask in these situations:

Situation	Why not	What to do instead
An insider Insider Threat A person with authorized access who uses it to harm the organization. CISA's definition covers malicious, complacent and unintentional acts; many programs, ASSURED included, reserve 'insider threat' for the malicious subset and use 'insider risk' for the broader set. hypothesis is live, even as one branch of several	You would be asking the suspect, and the question itself is the tip-off.	Take the insider route: the insider-program lead (or HR) and legal, before anyone talks to the subject.
The subject works in IT, security, or the SOC, or administers the systems in scope	They can see the case, the queries, or the logs, and can act on what they see.	Restrict the case to named people and verify through the owner of the change or the data instead.
The only channel you have is one the attacker may be reading	Asking on a compromised channel asks the attacker to vouch for themselves.	Use a channel from the out-of-band ladder, or do not ask yet.
A criterion is already confirmed	The answer cannot change the decision; escalation does not wait on it.	Escalate first. Contact the user afterward, to inform them, on IR’s timing.
Hands-on-keyboard activity or ransomware is suspected and containment is not yet coordinated	A warned user, or an attacker reading the warning, can trigger the rush to impact.	IR owns the timing. Preserve, take the pre-authorized actions in a coordinated way, then talk.

How to ask

The SOC’s call looks exactly like the attack users have been trained to refuse. Scattered Spider calls employees while posing as IT or help-desk staff, and calls the help desk while posing as employees (CISA AA23-320A); Storm-1811 has messaged and called users in Microsoft Teams under display names such as “Help Desk” and “IT Support” (Microsoft Threat Intelligence, May 2024, updated June 2024). A good verification call is built so that the user can check you, and so that nothing in it would help an attacker who later tries the same opening.

Owners, approvers, and managers

Authorization questions go to someone independent of the subject: the approver on the change ticket, the owner of the data store, the service owner for an automation account. Reach them through a contact you looked up, not one the case supplied. A ticket, a calendar invite, or an email thread can be a planted pretext, and the phone number in it can belong to the attacker. The same applies to an assisted password or MFA reset: verify it against its ticket and a call-back to a number already on file, as entity types describes for help-desk social engineering Help-Desk Social Engineering Calling the IT help desk while posing as an employee to get a password reset, MFA reset or new MFA device registered. Scattered Spider's signature entry path. .

The subject’s manager is a business-context source for routine questions (is this person on the quarter-end close, are they traveling). The manager is not a default contact. In an insider case the manager is told nothing unless the insider route decides otherwise, and in any case, ask the manager about the work, not about the person.

---

Out-of-band communication when the tools may be compromised

Attackers read the response. Scattered Spider searches a target’s Slack, Microsoft Teams, and Exchange Online for conversations about its intrusion, and frequently joins incident response calls (CISA AA23-320A, revised July 2025). The #StopRansomware Guide (May 2023) tells responders to use out-of-band methods Out-of-Band Communication A channel for coordinating a response that does not depend on the systems the attacker may control: a separate identity provider, a phone bridge, a pager. ATT&CK mitigation M1060. See Talking to people during triage. such as phone calls so they do not tip off actors, and MITRE ATT&CK lists the control as mitigation M1060.

Treat the in-band channels as compromised for a case when it touches any of these: the mail tenant, the chat workspace, the identity provider that signs users into them, the subject’s own account or device, or a session token the attacker holds for anyone on the response. In Case C, every contact went by pager, phone, or phone bridge, and the item-level message list went to compliance through the case system, because the mail tenant was the compromised system (see the Escalation example).

Channel	Use it when	Do not use it when
Corporate email and chat	Neither identity nor collaboration tools are in scope, and the subject is not an insider.	The case touches the mail tenant, chat, the IdP, or the subject’s account. Never notify a suspected victim by email from the affected tenant.
Case or ticketing system	Its access is restricted to named people and it does not sign in through the affected IdP.	It federates through the compromised identity provider, or the subject can read it.
Phone, to a number from a source the attacker could not edit	Verifying with users, owners, and stakeholders during an identity or mail compromise.	The only number you have came from the case itself, or from a directory profile the attacker could have changed.
Pager and on-call platform	Paging IR and the escalation chain, per the paging protocol.	The page would carry more than the six-line P1 page; keep case detail on the bridge.
Pre-provisioned out-of-band bridge or workspace	Coordinating a P1 or a declared incident: a phone bridge, or a workspace whose accounts do not federate to the affected IdP.	It was never tested, or its member list was built from the compromised directory.

Five habits keep the out-of-band channel out of band:

• Numbers from a trusted source. Take phone numbers from HR records or a contact list kept outside the affected systems, as they stood before the incident window. Attackers change the phone number on a profile and register their own MFA phone.
• No case detail in the tenant. A calendar invite, a meeting link, or a “call me” chat message in the compromised tenant announces the response. Send the bridge details out of band too.
• Bridge hygiene. Lock the bridge, take a roll call, and verify every voice that joins. Anyone you cannot place gets dropped and the bridge details are replaced.
• Callers prove who they are. Anyone who calls the response, including someone who sounds like an executive or a colleague, gets a call back Call-Back Verification Confirming a caller or an instruction by calling a number you looked up from a trusted source, never the number supplied in the contact. See Talking to people during triage. on a number you looked up. AI-generated voice is now often difficult to identify (FBI PSA I-051525-PSA, May 2025).
• Tell the business what to distrust. When mail is compromised, put the people who move money on notice that payment and bank-detail instructions from or about the affected mailboxes need out-of-band verification until the case closes, as Cases A and C did (see the Scope example). That is the business email compromise Business Email Compromise (BEC) Phishing's no-payload variant: an email impersonating an executive, vendor, or counterparty that asks the recipient to move money or change payment details. With no attachment to detonate and no link to rewrite, gateway verdicts stay quiet; the evidence lives in lookalike domains, display-name and reply-to mismatches, and hijacked threads sent from a compromised counterparty's real mailbox. Consistently among the costliest crime types by reported losses in the FBI IC3 Internet Crime Reports (about $3 billion in the 2025 report). path the attacker was building toward.

---

The language card

Everything said in a ticket, a chat thread, or a call note can be read later by a regulator, an auditor, or opposing counsel, and involving counsel does not by itself shield it. Courts ordered breach forensic reports produced in In re Capital One (E.D. Va. 2020) and Wengui v. Clark Hill (D.D.C. 2021). The writing for discovery standard governs the written record; the card below carries the same discipline into conversation and chat.

Say	Not	Why
“event”, “incident”, “suspected unauthorized access”	“breach”	Whether something is a breach Data Breach A security incident that results in unauthorized access to, or accidental or unlawful loss, alteration, destruction or disclosure of, protected data. Whether an event is legally a breach (and starts a notification clock) is for privacy or legal counsel to decide, not the analyst. Scale is irrelevant, and accidental disclosures can qualify. See Scope > Regulatory. is a legal determination that counsel makes, with its own clocks.
“unauthorized access to mailbox content confirmed: about 1,800 messages read by the consented app”	“they stole everything”	State what the evidence shows, with its scope. Volume claims without a source become the number everyone repeats.
“the account was used from 198.51.100.77 after a session was replayed”	“the user got hacked”, “fell for it”	Describe what people did, not what they are. The user is the first victim (see writing about people).
“not yet determined”, “no outbound mail in message trace for the case window”	“probably nation-state”, “probably nothing”, “nothing happened”	Speculation in writing hardens into fact. Absence of evidence is scoped to a source and a window.
“control gap: push MFA, not phishing-resistant”	“negligent”, “failed to comply”, “our fault”	Control findings are facts; fault and compliance are legal conclusions.
“compliance is assessing obligations”	“we have to notify”, “we don’t need to report this”	Notification is legal’s call. The analyst’s job is the timestamp and the facts (see Scope: regulatory).

Three rules go with the card:

• Do not speculate in writing. Chat is a record. Hypotheses belong in the case, labeled as hypotheses, not in a side thread.
• Mark counsel communications, and follow counsel’s instructions. Once counsel directs the investigation, follow their instructions on where analysis is written, how it is labeled, and who receives it. Keep the factual triage record complete and separate from counsel-directed analysis. A “privileged” label does not create privilege, and forwarding counsel’s messages widely can waive the protection they have.
• Say less on the phone than you know. A user, a manager, or a vendor needs what they must do next, not the case. “We’re looking into unusual activity on your account” is the whole briefing for most users.

---

Special routes

Four kinds of case change who you talk to, and who you must not. Each route is named in the escalation protocols; this table is the triage view.

Route	Talk to	Do not talk to	First move
Insider and HR	The insider-program lead (or HR where no program exists) and legal, on one bridge with the IR lead.	The subject, the subject’s manager or team, or HR about “why”.	Restrict the case to named people. Record observable technical activity only; HR-held context reaches the case only through the insider-risk route, never as analyst-collected notes. The HR referral example runs the route end to end.
Executive or VIP subject	The contact the protocol names (often the CISO or the security lead for executive protection), who decides how the executive is approached.	Executive assistants and delegates by default: they often hold delegate rights on the mailbox, so they are both in scope and a possible channel for the attacker.	Treat urgency and seniority as signals, not authority. Any instruction from or for the executive is verified by call-back on a known number; whaling Whaling Spear phishing targeting high-profile individuals like executives, often for financial fraud (business email compromise) or data theft. and deepfake Deepfake Synthetic audio, video or images generated to impersonate a real person. In triage it defeats "I recognized the voice" or "I saw them on the call" as identity proof for help-desk resets and payment approvals; verify through a separate, known channel instead. See AI-assisted triage. voice target exactly this route.
Suspected ransomware or extortion	The IR lead, out of band from the first message. Legal engages the insurer and law enforcement; the SOC does not.	The threat actor, ever. Users who receive extortion contact report it and do not reply; negotiation belongs to IR, counsel, and the insurer.	Isolate in a coordinated way, after preservation, and do not warn users in a channel the attacker can read. Any payment discussion is legal’s, with sanctions screening and its own payment reporting clocks (see external parties).
Regulator, law enforcement, or press	Legal (and communications for press), immediately.	The caller, beyond taking details. The SOC does not contact regulators or law enforcement directly.	Take the name, agency, reference, and a call-back number; confirm nothing, deny nothing, and verify the caller through a published number. An outside notice of compromise can be the moment of awareness: record its time for legal (see Scope: regulatory and the regulatory clock card).

For a managed security service provider (MSSP) Managed Security Service Provider (MSSP) An outsourced provider that monitors and triages security events for many customers. The provider owns the triage; the customer keeps accountability for the asset, the business context and the decisions only an owner can make. See Managed Detection and Response (MDR) and Running ASSURED as an MSSP or MDR. or managed detection and response (MDR) Managed Detection and Response (MDR) An outsourced service that monitors an organization's telemetry, triages alerts and often takes first response actions on its behalf. The provider triages; accountability for the outcome stays with the customer, so the escalation path, pre-authorized actions and evidence-sharing terms belong in the contract. provider, the escalation is the customer notification, and the language card applies to it as much as to internal chat. The contract’s named contacts may sit inside the compromised tenant, so agree an out-of-band contact path at onboarding.

---

The communication record

Every contact on this page ends as one row in the communication record, section 9 of the handoff packet and the matching part of a closure record. The row carries the time (UTC), who was contacted and by whom, the channel, what they were told in one line, what they said or decided, and the reason when a contact was deliberately not made. Case C’s record shows the shape:

The record prevents duplicate and contradictory messages and starts the audit trail regulatory reporting will need. If priority later moves down, everyone told about the escalation is told about the downgrade.

Sources

• CISA, FBI and partners, Scattered Spider, AA23-320A (released November 16, 2023; revised July 29, 2025): searching Slack, Teams, and Exchange Online for the security response, and joining remediation calls.
• CISA, FBI, NSA, and MS-ISAC, #StopRansomware Guide response checklist (updated May 2023): out-of-band communication methods to avoid tipping off actors.
• MITRE ATT&CK, M1060 Out-of-Band Communications Channel (created August 2024).
• Microsoft Threat Intelligence, Threat actors misusing Quick Assist in social engineering attacks leading to ransomware (May 15, 2024; updated June 2024 with Storm-1811’s Teams help-desk impersonation).
• FBI, Senior US Officials Impersonated in Malicious Messaging Campaign, I-051525-PSA (May 15, 2025): verify by independently identifying a number and calling back.
• Wengui v. Clark Hill, PLC, No. 19-3195 (D.D.C. January 12, 2021), and In re Capital One Consumer Data Security Breach Litigation (E.D. Va. 2020): forensic reports ordered produced despite counsel’s involvement.

Next up

Triage vs. incident response

Read the distinction