What should I do if I suspect an active cloud compromise?¶
If you suspect an active cloud compromise, treat it as both a security incident and an evidence-preservation problem.
The immediate priorities are to understand the access, preserve volatile records and prevent further harm.
What this means in practice¶
A password reset may alert the attacker, end useful sessions, alter records or fail to remove other access routes. It may still be necessary, but the action should be coordinated.
Start by defining what is happening. Which account, tenant, devices, applications and data are involved? Is there ongoing harm, data loss, victim risk or access to other systems?
Containment may require revoking sessions and tokens, removing applications, resetting credentials, disabling accounts and reviewing identity-provider access. Those actions should be proportionate and documented.
Also consider linked accounts. A compromised email or identity provider may allow access to several other services.
What this does not show on its own¶
The dangerous assumption is that the first action should always be to change the password.
Do not interact with the attacker or use recovered credentials or tokens to explore the account without lawful authority and specialist advice.
What to do next¶
Preserve available authentication logs, sessions, tokens, application consent, account changes, administrator actions, security alerts and relevant device evidence.
Record the time, time zone, source and method of collection.
Identify whether the attacker has created persistence through new users, trusted devices, recovery methods, delegated applications, API keys or service accounts.
Seek specialist support early where the account is live, business-critical, legally sensitive or technically complex.
Key takeaway
Preserve the live cloud evidence, identify every access route and coordinate containment so that urgent security action does not unnecessarily destroy the evidential picture.