The specific steps to take in the first 60 minutes after detecting a suspicious login. A practical incident response guide for companies without a security team.
Executive summary: A suspicious login alert means someone accessed a business account from an unexpected location, device, or time. It does not mean you have been breached — it means you have a signal that requires investigation. The first 60 minutes after detection determine whether a potential compromise is contained or escalated. This guide provides the specific steps to take, in order, for companies without a dedicated security team. The sequence prioritizes containment over investigation because limiting potential damage matters more than understanding the attack when you are in the critical response window.
You just received an alert: someone logged into a business account from an unfamiliar location at 3 AM. Your heart rate increases. You do not have a security team. You do not have an incident response playbook. What do you do right now?
A suspicious login is a decision point. Handle it correctly in the first hour and you contain the potential damage to a minor incident. Handle it incorrectly — or do not handle it at all — and you may discover days later that an attacker has been in your systems, reading your email, accessing client data, and preparing a larger attack. The instinct to ignore alerts because they are usually false positives is the instinct that turns a manageable incident into a catastrophic one.
Within 15 minutes of a suspicious login alert, the affected account's password is reset and all active sessions are terminated. Within 30 minutes, you have checked whether the login was legitimate by contacting the account holder. Within 60 minutes, if the login was unauthorized, you have identified what the account had access to, reviewed recent activity for data access or changes, and determined whether other accounts may be affected. The difference between a good response and a bad response is speed and sequence — not expertise.
Most suspicious login alerts are legitimate users on vacation, using a VPN, or logging in from a new device. This creates alert fatigue that leads to ignoring the one that is actually malicious. Every alert deserves a verification — even if it takes only two minutes.
The natural instinct is to understand what happened before taking action. In incident response, this is backwards. Contain first — reset the password, terminate sessions — then investigate. Every minute spent investigating before containing is a minute the potential attacker retains access.
A compromised account may have been used to access other systems, create new accounts, or modify configurations. Checking only the initially compromised account misses activity the attacker performed after gaining initial access.
Accounting firm (Financial Services): < 20 min total containment time for unauthorized access. A suspicious login from an overseas IP was detected at 11 PM. Following a documented response procedure, the on-call administrator reset the password and terminated all sessions within 8 minutes. Investigation confirmed unauthorized access but no data exfiltration because the response was faster than the attacker's plan.
Marketing agency (Marketing Services): 2 additional accounts identified as compromised through lateral movement check. Initial suspicious login investigation revealed the attacker had used the compromised account to access two additional accounts through password reuse. The lateral movement check — which many companies skip — caught the expanded compromise before any client data was accessed.
| Metric | Before | After |
|---|---|---|
| Time to Containment | No procedure (hours/days) | < 15 minutes |
| Lateral Movement Detection | Never checked | Standard procedure |
| Alert Response Rate | ~30% investigated | 100% verified |
A suspicious login alert just appeared. Someone accessed a business account from an unfamiliar location, at an unusual time, or from an unrecognized device. Here is exactly what to do.
Do not investigate first. Contain first. Reset the password for the affected account immediately. Then terminate all active sessions — force a logout on every device. This takes two to three minutes and immediately cuts off any unauthorized access.
If the login was legitimate and you just reset a coworker's password, that is a two-minute inconvenience. If the login was malicious and you delayed containment to investigate, you gave the attacker additional time with access to your systems.
Contain first. Apologize to coworkers later.
Contact the account holder directly by phone. Do not use email — if their account is compromised, the attacker may be reading their email. Ask three questions: Did you log in at this time? Were you in this location? Were you using this device?
If they confirm the login was theirs, re-enable their access with a new password, document the false positive, and close the alert.
If they deny it, or you cannot reach them, proceed to investigation.
Review the account's activity during the suspicious period. Check: emails sent from the account, emails forwarded or rules created, files accessed or downloaded, systems the account logged into, and any administrative actions performed.
Look specifically for signs of persistence — things an attacker sets up to maintain access even after you change the password: email forwarding rules to external addresses, new devices registered for MFA, new application permissions granted, and password reset requests for other accounts.
Determine whether the compromised credentials were used to access other systems. Check login logs for other business applications accessed during the same period. Check whether the same password was used on other accounts. Review whether the account was used to access shared drives, administrative consoles, or client-facing systems.
Lateral movement detection is where most companies fail during incident response because they focus only on the initially compromised account. An attacker who gains access to one account will attempt to expand that access to additional systems.
Document what happened, what you found, and what actions you took. Then evaluate whether the incident reveals gaps in your security controls that should be addressed: Was MFA not enforced on the compromised account? Were permissions too broad? Was there no alerting configured?
Every incident is a diagnostic opportunity. Use it.
Part of the Security Hardening insights cluster at JubilantWeb. Reviewed by Nelson Penagos, Founder & Systems Architect. Contact: hello@jubilantweb.com | (407) 630-8771
Contact the account holder directly — by phone, not by email (their email may be compromised). Ask if they logged in at the time, from the location, and using the device indicated in the alert. If they confirm the login was theirs, document it and close the alert. If they deny it, or if you cannot reach them within 15 minutes, treat it as potentially malicious and proceed with containment: reset the password and terminate all active sessions. It is far better to inconvenience a legitimate user with a password reset than to give an attacker continued access while you wait for confirmation. The password reset takes two minutes to undo if the login was legitimate.
Reset the password and terminate all active sessions as the first action. Disabling the account is appropriate if you have strong evidence of compromise and want to prevent any access while you investigate, but it also prevents the legitimate user from working. Password reset with session termination achieves containment — the attacker's session is terminated and they cannot re-authenticate with the old password — while allowing the legitimate user to regain access once you have communicated the new password. If investigation reveals the compromise is more extensive than a single account, then consider disabling while you assess the full scope.
After containing the incident, investigate three areas. First, review the account's recent activity: emails sent, files accessed, systems logged into, and any configuration changes made during the suspicious period. Second, check for signs of persistence: new forwarding rules in email, new devices registered for MFA, new API keys or application permissions granted, or new user accounts created. Third, check whether the compromised credentials were used to access other systems — especially systems that share the same password. Each of these areas can reveal whether the incident was a failed attempt, a successful but limited compromise, or the beginning of a broader attack.
Call a professional if any of these conditions are true: the compromised account had administrative access to critical systems, you find evidence that data was accessed or exfiltrated, you discover signs of persistence such as new accounts or forwarding rules you did not create, multiple accounts appear compromised, or the attacker modified system configurations or security settings. For a single account compromise with no evidence of data access or lateral movement, your internal response following this guide is typically sufficient. For anything beyond that, professional incident response is worth the cost because the complexity of the investigation and remediation exceeds what most companies without security staff can handle effectively.
Four controls significantly reduce suspicious login risk. First, enforce MFA on all accounts — this prevents credential-based unauthorized access entirely. Second, configure conditional access policies that restrict logins from unexpected countries or require additional verification for unusual login patterns. Third, implement a password manager and prohibit password reuse across business systems — this prevents a credential compromised in one breach from being used to access your systems. Fourth, enable login anomaly detection in your identity platform so you receive alerts promptly rather than discovering unauthorized access days or weeks later. These controls do not eliminate all risk but they make unauthorized access significantly harder to achieve and faster to detect.