Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If an employee’s work account may be compromised, report it through your organization’s known-good security or IT channel and treat it as an incident—not as a password-reset task alone. The incident lead should determine the likely scope, preserve relevant evidence, contain access, remove unauthorized authentication methods and persistence, then recover the account and assess possible data exposure.
What should you do first?
Contact the designated security or IT incident team using a trusted channel, such as the organization’s internal reporting process or a verified phone number. Do not follow contact instructions in a suspicious email, text, or sign-in prompt. The organization should coordinate the response because identity-provider controls and evidence preservation are often administrator-managed.
Record the affected account, when the issue was first noticed, what suspicious prompts or changes appeared, which devices may be involved, and what systems the account can reach. Preserve relevant authentication and audit logs before they expire or are overwritten. CISA’s incident guidance emphasizes log collection and using the organization’s incident-response and communications plans.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Before disabling accounts or forcing broad resets, the incident lead should weigh the evidence, business impact, and risk of disrupting critical work. A single suspected credential leak may call for targeted containment; signs of identity-provider, directory, administrator, or multiple-account compromise may require a wider response.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How broad should the response be?
Choose scope from the evidence and the account’s reach, rather than treating every suspicion as proof of an organization-wide compromise.
| Response scope | When it may fit | What should influence the decision |
|---|---|---|
| Targeted containment | Evidence points to one employee’s credential or authenticator, with no sign of wider access. | Whether the account has elevated privileges; what systems and data it can reach; and whether unfamiliar factors, tokens, or app grants appear. |
| Broader identity-environment response | Logs or other evidence suggest administrator, directory, identity-provider, or multiple-account compromise. | Indicators of spread or persistence, business disruption, reachable services, and the incident plan’s escalation triggers. |
CISA has recommended broad credential resets in particular incident contexts, including a notice advising affected organizations to reset compromised credentials and an advisory describing resets for all users in a victim organization. Those actions are incident-specific examples, not a universal requirement for every suspected breach.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should administrators contain access?
- Restrict the account if needed. An administrator should disable or limit a confirmed compromised account when necessary to stop ongoing access, coordinating with responders so that the action does not unnecessarily destroy evidence or interrupt critical operations.
- Reset the password through the trusted identity-provider workflow. If the employee reused that password elsewhere, reset it on every other affected account too. CISA specifically advised resetting accounts that reused a password after possible exposure.
- Remove compromised or unrecognized authenticators. Invalidate compromised MFA factors and remove devices or methods the employee does not recognize. NIST SP 800-63B Revision 4 states: “The CSP SHALL suspend, invalidate, or destroy compromised authenticators from the subscriber’s account promptly following compromise detection.” NIST also says organizations should set time limits for this process.
- End sessions and revoke tokens where supported. Use the provider’s controls to revoke active sessions and refresh tokens, review connected application grants, and require fresh sign-in. Confirm how the identity provider handles revocation: changing a password does not necessarily terminate every existing session or delegated token. NIST notes that access tokens can remain valid after an authentication session ends.
What signs of persistence and wider access should you investigate?
Review sign-in history and audit events covering the period around the suspected compromise. Look for unfamiliar locations or devices, changes to recovery details, new authentication factors, and activity inconsistent with the employee’s normal access.
- MFA enrollment, removal, or reset events, especially a device or factor the employee cannot identify.
- Password-recovery activity and changes to recovery email addresses or phone numbers.
- Mailbox forwarding, inbox rules, or other settings that could expose or divert messages.
- Unusual file access, newly authorized connected apps, or permissions the employee did not grant.
- Access to other accounts or services through single sign-on, including privileged accounts and administrative systems.
CISA has documented cases in which threat actors registered their own MFA devices and abused self-service password reset. If the evidence points beyond one account, expand the investigation to the identity provider, administrative accounts, endpoints, and connected services, and involve relevant service providers as the organization’s incident plan directs.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How should the employee regain access safely?
- Verify identity through an established recovery path. Use the organization’s supported identity-provider process rather than an informal bypass. NIST recovery requirements vary by assurance level; NIST also calls for recovery notifications and recommends backup authentication methods that let users report loss or compromise securely.
- Register only employee-controlled authentication methods. Confirm that the employee recognizes and controls each factor added during recovery. Do not leave unfamiliar factors in place.
- Set a new, unique password. NIST SP 800-171 Revision 3 says to select a new password at first use after account recovery and to maintain a blocklist of commonly used, expected, or compromised passwords. Apply the organization’s password policy and check the new choice against the organization’s approved blocklist.
- Require MFA and prefer phishing-resistant methods where available. Prioritize email, remote access, administrative accounts, file storage, and accounts handling sensitive data. CISA’s business guidance and ransomware guidance emphasize phishing-resistant MFA for high-impact access, including email, VPN, and critical systems.
A FIDO2 security key can be an optional way to strengthen authentication if the identity provider supports the key and the organization can deploy it appropriately. It does not replace incident containment, authenticator cleanup, account recovery, or provider-side session controls.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should the organization assess exposure and close out?
Determine what information and services the account could access, then use audit and access records to establish whether information was viewed, changed, or taken. Record the actions performed, evidence retained, affected services, and any monitoring or follow-up assigned.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the investigation indicates a data breach, follow the incident plan and have privacy or legal staff assess notification duties under the applicable law. The answer depends on where affected people are located, what information was involved, and what the investigation establishes about access. Tell the employee where to report further unexpected recovery prompts or signs of renewed access.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
