The accounts team says a supplier's reply has disappeared. Someone else keeps getting sign-in prompts on their phone. The backup report hasn't arrived for two days.
Each problem might have an ordinary explanation. Taken together, they deserve a proper check.
Detecting early cyber threats means noticing changes, checking them against normal work and getting the right person involved before the damage grows. Staff don't need to prove an attack has happened before reporting a concern. They do need a clear route for reporting it.
This guide focuses on those first checks. If files are being encrypted, money is at risk or access is clearly being abused, move straight to responding to a cyber attack.
Decide who receives the warning
Choose a named business owner for security reports and a deputy for absence. Agree which IT provider or administrator they contact, using a number already held in your records.
Write down the hours covered. A mailbox checked on Monday morning won't provide an urgent response on Friday night. If the business needs support outside working hours, agree that service explicitly.
Give staff a simple reporting request: say what happened, when, which account or device was involved and whether they clicked, entered information or approved anything. Don't ask them to send passwords or verification codes.
If email may be affected, use the agreed phone route instead. An alert about a compromised mailbox shouldn't depend on that same mailbox reaching somebody safely.
Five changes worth checking
These are practical examples, not a complete detection system. Start through the known application or admin portal, rather than a link in an unexpected alert email. Technical checks belong with an authorised administrator.
1. An unexpected sign-in or approval prompt
Possible explanation: a new phone, a work VPN or an application asking somebody to sign in again.
Safe check: ask the person whether they initiated it. Never approve an unexpected prompt to make it disappear. Have the administrator compare the time, account, application, device details and whether access actually succeeded.
Escalate: an unrecognised successful sign-in, repeated unwanted prompts or an authentication method nobody authorised.
A location label isn't proof of where a person was. Microsoft explains that IP addresses and physical locations don't have a definitive connection. Mobile networks and VPNs can make legitimate activity appear somewhere else. Equally, a familiar country doesn't prove access was legitimate.
2. Missing messages or unfamiliar mail rules
Possible explanation: somebody changed a filing rule or a colleague moved messages from a shared inbox.
Safe check: ask an administrator to review forwarding and inbox rules, including rules not visible in the person's normal email view. Record what changed and when.
Escalate: an unknown forwarding address, unexplained rules hiding replies or messages sent without the account owner's knowledge.
These are among the warning signs in Microsoft's compromised account guidance. Deleting a rule alone doesn't establish how someone gained access or whether they still have it.
3. Device protection reports a problem
Possible explanation: a failed update or a planned software change. A slow laptop alone is weak evidence of an attack.
Safe check: the administrator checks the managed security console for the alert, affected device and action taken. Don't release a quarantined file or disable protection just to get work moving.
Escalate: malware keeps returning, protection has been disabled unexpectedly or several devices show related alerts.
CISA's ransomware guidance advises routing malware warnings to people who can act. A detection marked as blocked still deserves review in context.
4. Backups fail or protection settings change
Possible explanation: a storage limit, expired connection or planned maintenance.
Safe check: check the actual backup service, its recent job history and approved changes. A missing email report doesn't tell you whether the backup ran.
Escalate: unexplained backup deletion, disabled jobs or changes that make protected copies easier to alter. CISA warns that ransomware can target accessible backups. Don't start deleting or reconnecting backup copies while investigating.
5. Somebody gains unexpected access
Possible explanation: an approved starter, supplier change or temporary support arrangement.
Safe check: compare the new account or administrator permission with the recorded approval. Verify it with the responsible person through a trusted route.
Escalate: nobody approved the change, logging has been switched off or an unknown account has privileged access. CISA's logging guidance includes administrator activity and privilege changes among the events worth monitoring.
What a sensible first check looks like
Imagine a fictional stationery company. Priya, its office manager and nominated reporting contact, receives a call from a colleague about missing customer replies.
Priya notes the time, mailbox and missing conversation. She calls the IT provider using its stored support number. She doesn't ask everyone to reset passwords or search through other people's mail.
The provider finds a new rule moving replies out of view. The mailbox owner doesn't recognise it, and there's no support ticket explaining the change. Priya records those facts separately from the suspicion that the account has been compromised.
That is enough to begin the incident process. The authorised responder decides on containment, preserves relevant records and investigates the scope. Priya coordinates business decisions through a trusted phone channel.
If the rule had matched a documented, approved change, the team could have recorded the explanation and closed that concern. The value of reporting doesn't depend on finding an attacker every time.
Check that your alerts actually reach someone
Ask your provider to explain which services produce useful records, where those records are kept and how quickly someone reviews an urgent alert. Agree how to test notification delivery safely without generating a real attack.
The NCSC's logging guidance recommends choosing records around the questions an incident investigation needs to answer. Check access and retention before you need them, and restrict who can read or alter the records.
No alerts doesn't mean no compromise. Logging may be missing, notifications may fail and some activity may not trigger a detection. Keep these checks alongside the routine work needed to maintain cyber security, with a named person following up anything unexplained.