Recommended Free Tools
Immediately contain the person’s access, preserve relevant evidence, and start a coordinated investigation. Disable known accounts and revoke active sessions and tokens across identity, email, VPN, cloud services, applications, and remote-management tools; then establish what the person could reach and what may have changed. Treat “fraudulent hire” as an allegation until the evidence supports it. Involve security or IT, HR, legal, leadership, and affected system owners, and use a trusted channel if company communications may be compromised.
What should you do first?
Have an incident lead coordinate the response. Assign clear decision-making authority, keep a timeline of actions and discoveries, and involve people who own the affected systems. The FBI recommends having an incident-response playbook that identifies roles, isolation actions, evidence-preservation steps, and law-enforcement contacts. If there is a plausible risk that email or another internal channel is monitored, choose a trusted alternative for incident coordination.
As an Amazon Associate I earn from qualifying purchases.
Do not wait for a complete investigation before stopping access that could still be used. At the same time, avoid taking steps—such as wiping a device—that could destroy evidence. Balance immediate risk reduction against the need to preserve records and investigate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do you contain digital access?
Disable the identity-provider account and every known account assigned to the person. Revoke active sessions and tokens, and reset credentials where appropriate. Check privileged roles, delegated credentials, and remote access—not just the person’s primary login.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check every access path
- Identity and authentication: Review identity-provider accounts, administrator roles, authentication tokens, and any newly created accounts or privilege changes.
- Work and communication systems: Check email, collaboration platforms, source-code services, finance and HR systems, and other relevant applications. Look for mailbox forwarding rules or other account changes.
- Infrastructure and remote access: Disable VPN and remote-management access, and review relevant cloud consoles, network infrastructure, and application servers.
- Access that may not be tied to the named user: Check shared accounts, service credentials, API keys, OAuth grants, and access granted through vendors. These are investigation checks, not proof that any such access was misused.
A single password reset or account disablement may not terminate existing sessions or remove access through other accounts, applications, credentials, or systems. NIST’s insider-threat guidance calls for prompt IT-access disablement in its employee-sabotage and termination discussion; the NCSC/CERT insider-threat guide also identifies VPN, email, application servers, network devices, remote-management software, open sessions, and issued MFA tokens as access paths to address.
What evidence should you preserve?
Preserve relevant records promptly. Logs may rotate, have short retention periods, or be removed through routine cleanup. Keep collection decisions coordinated with counsel and qualified responders, especially if litigation or law-enforcement involvement may be possible.
Prioritize records that can establish access and activity
- Identity-provider and authentication events, including session and privilege changes.
- Email activity, including account changes and forwarding rules.
- Cloud audit logs, endpoint telemetry, VPN and remote-access records, and relevant network or DNS activity.
- Records of data downloads or exports, code changes, configuration changes, and access to sensitive systems or records.
- Physical-entry records, equipment inventories, HR and employment records, and relevant witness reports.
Centralize and protect the evidence where possible, retain the incident timeline, and account for differences in system clocks when comparing events. FBI incident-response guidance emphasizes protected, centralized logs and synchronized clocks; CISA’s insider-threat guidance describes collecting evidence across HR, cybersecurity, and physical-security sources.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not casually erase, reset, or reimage a potentially relevant device. If it presents an active risk, coordinate isolation and evidence preservation with the incident lead and qualified responders. The right method depends on the urgency of the risk and the organization’s response capability.
How do you determine what the person accessed?
Build a time-bounded access map: identify the person’s accounts, group memberships, permissions, devices, reachable systems and data, physical access, and third-party services. Compare what was assigned with what logs and other records show was actually used.
Review for authentication patterns, account creation, privilege changes, mailbox rules, data downloads or exports, code or configuration changes, and access to sensitive records. Reconcile system evidence with employment records, equipment inventories, physical-security logs, and witness reports. A cross-functional review helps distinguish confirmed activity from access that was merely possible; neither assume no harm occurred nor treat every reachable system as compromised.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What company equipment and physical access should you address?
Disable physical badges and other access credentials, and recover company-owned equipment where feasible. Check the inventory for computers, phones, keys, smart cards, MFA tokens, and other issued items. Review whether the person—or anyone else—used physical access during the relevant period.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The NCSC/CERT insider-threat guide’s separation procedures specifically include closing sessions, disabling remote services, and collecting company equipment, including MFA tokens. Apply those checks alongside digital containment rather than treating a disabled login as the whole response.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When should you involve counsel, law enforcement, or regulators?
Engage counsel early to assess employment and privacy issues, evidence handling, contractual duties, insurance requirements, breach-notification obligations, and whether law enforcement or other authorities should be contacted. Coordinate external reporting and evidence handling so internal actions do not interfere with a potential investigation. CISA’s insider-threat guidance stresses cross-functional coordination and consideration of whether actions could compromise a prosecution.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reporting duties depend on the facts and the organization’s jurisdiction, sector, status, data, and contracts. For a U.S. public company subject to SEC rules, the FBI summarizes the requirement as filing Form 8-K Item 1.05 within four business days after the company determines that a cybersecurity incident is material. The rules allow a limited Department of Justice delay under specified conditions involving substantial risks to national security or public safety. This is a specific SEC disclosure rule, not a general breach-notification deadline for every organization.
What is established—and what still needs to be verified?
Official guidance supports prompt access revocation, timely evidence preservation, coordinated investigation, recovery of company equipment, and deliberate legal and law-enforcement decisions. It does not establish that a particular hire committed fraud, that data was taken, or that a specific notice is required. Those conclusions depend on verified evidence and the applicable laws, contracts, sector rules, and company status.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
