What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Report a suspected work-account breach to your organization’s security or IT incident lead immediately. Treat it as an incident, not just a password-reset request: responders should contain the account, preserve evidence, check for ways the attacker could return, and coordinate recovery through the organization’s identity provider.
Choose the response scope before making broad changes
A suspected breach does not automatically call for resetting every employee’s password. The incident lead should match the response to the evidence and the account’s reach. CISA’s incident-specific actions—including resets affecting all users in one victim organization—were tied to particular incidents, not a universal rule.
As an Amazon Associate I earn from qualifying purchases.
| Response scope | When it may fit | What to weigh |
|---|---|---|
| Targeted containment | Evidence points to one employee’s credentials or authenticator, with no sign of wider access. | Whether there are signs of persistence or spread; the account’s privileges; what systems and data it can reach; and the operational effect of restrictions. |
| Broader identity-environment response | Logs suggest compromise of an administrator, directory, identity provider, or multiple accounts. | Scope across accounts and connected services, persistence indicators such as unfamiliar MFA factors or app grants, business disruption, and the incident plan’s escalation triggers. |
Use the organization’s incident-response plan to decide and coordinate the scope. Preserve relevant authentication and audit logs before actions that could affect evidence. CISA’s ransomware guidance calls for log collection and use of incident-response and communications plans.
Free tools Windows power users keep installed
One-click scans. No signup required.
What to do, in order
1. Report the suspicion and record what is known
- Contact the designated security or IT team using a known-good channel. Do not follow contact instructions in a suspicious email or message.
- Tell responders which account is involved, when the issue was first noticed, what suspicious prompts or changes appeared, which devices may be affected, and which systems the employee can access.
- Let the incident lead coordinate investigation and any containment. Broad shutdowns or resets can disrupt critical work, so responders should consider operational impact as they act.
2. Contain access and reset compromised credentials
An administrator should disable or restrict a confirmed compromised account if needed to stop ongoing access, coordinating with responders to preserve evidence and manage disruption. Reset the password through the organization’s trusted identity-provider workflow. If the employee reused that password, reset it on every other account where it was used; CISA’s CSAT notice advised this after possible account exposure.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Invalidate compromised MFA authenticators and remove any registered device or factor the employee does not recognize. NIST SP 800-63B Revision 4 states: “The CSP SHALL suspend, invalidate, or destroy compromised authenticators from the subscriber’s account promptly following compromise detection.” NIST also says organizations should set time limits for doing so.
Where the identity provider supports it, revoke active sessions and refresh tokens, inspect connected-application grants, and require a fresh sign-in. A password change does not guarantee that every existing session or delegated token has ended: NIST notes that access tokens can remain valid after an authentication session ends, so responders should verify the provider’s actual revocation behavior.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Investigate persistence and determine what was reachable
Review sign-in history and audit events around the suspected compromise. Check for unfamiliar locations or devices, MFA enrollment or reset events, changes to recovery addresses or phone numbers, suspicious mailbox rules or forwarding, unusual file access, and new authorizations for connected apps.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Assess the employee’s privileges, single sign-on access, and the other accounts or services reachable from that identity. CISA advises collecting relevant logs and reviewing access and conditional-access policies. In an October 2024 advisory, CISA described observed cases in which threat actors registered their own MFA devices and abused self-service password reset.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If evidence points beyond one account, extend the investigation to the identity provider, administrative accounts, affected endpoints, and connected services. Escalate to the incident-response lead and service providers according to the organization’s plan; CISA’s guidance emphasizes identity and access management, least privilege, phishing-resistant MFA, and validating security controls.
4. Recover the employee’s identity and strengthen sign-in
Verify the employee through an established recovery path, then bind only authenticators the employee controls. NIST calls for recovery notifications and recommends backup authentication methods so users can report loss or compromise securely. Recovery requirements vary by assurance level, so use the identity provider’s supported process rather than an informal bypass.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Set a new, unique password and block commonly used, expected, or known-compromised choices. NIST SP 800-171 Revision 3 says to select a new password on first use after account recovery and maintain a list of commonly used, expected, or compromised passwords.
Require MFA wherever available, prioritizing administrative accounts, email, remote access, file storage, and accounts handling sensitive data. Prefer phishing-resistant MFA where supported. CISA’s business guidance highlights these account types, and its ransomware guidance specifically calls out email, VPN, and accounts with critical-system access.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
5. Communicate, document, and follow up
Tell the employee how to recognize legitimate recovery messages and where to report further prompts or unusual access. Record actions taken, evidence retained, affected services, and any follow-up monitoring.
Determine what information the account could access and whether investigation indicates that information was viewed or taken. If a data breach is indicated, have privacy and legal staff assess notification duties under the applicable incident plan and law. Requirements depend on where affected people are located, what data was involved, and what was accessed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
