What Should Employees Do After Clicking a Suspicious Link?

After an employee clicks a suspicious link, the next step depends on what happened: a page may have loaded, credentials may have been entered, a file may have been downloaded, or nothing may have occurred. Quick reporting helps responders preserve evidence and decide whether to isolate a device or reset access.

Report facts without blame

Ask the employee to report the message, click time, affected device, browser, and any information entered or file opened. Keep the original message if the security team needs headers or a sample. Avoid forwarding it widely, since that can expose more people to the link.

• If credentials were entered, notify the identity or security team immediately.
• Do not delete browser history or suspicious files before responders advise.
• Use a clean device for password changes when account exposure is suspected.
• Follow the organization's device isolation procedure if a file ran or a warning appeared.

Informatix Systems lists cybersecurity and incident response related services. A readiness review can help define reporting, containment, and account recovery steps. Contact Informatix Systems to discuss employee phishing response.