Incident Response When Remote Assistants Are Part of Your Team

Security incidents rarely announce themselves. They start with a suspicious email, a login prompt that seems slightly wrong, a payment request that doesn't quite fit or a file shared to the wrong person. Remote assistants, who often sit at the center of an executive's email, calendar and payments, are both a potential target and a potential early-warning system. Whether they help or hurt during an incident depends on preparation.

This guide explains how to include remote assistants in your incident response approach: what they should recognize, how they should report, how you contain access and how to work with their provider. It complements our vendor risk review guide and our article on data security for remote assistants.

Why assistants matter in incident response

Executive and finance assistants are attractive targets. Attackers know they can schedule meetings, forward documents, initiate payments and speak on behalf of leaders. Common attacks include:

• Phishing to steal credentials, often through fake login pages.
• Business email compromise, where attackers impersonate executives or vendors to request payments or sensitive data.
• MFA fatigue, where repeated push prompts pressure someone into approving.
• Gift card and urgent payment scams that impersonate a leader.
• Malicious attachments or links disguised as invoices, contracts or calendar invites.

At the same time, assistants see patterns: an unusual request from a "vendor," an executive's account sending odd messages, a meeting invite from an unknown domain. If they know what to look for and feel safe reporting, they can catch incidents early.

What assistants should recognize

Training should give assistants concrete examples relevant to their work:

• Requests to change bank details or pay urgently, especially by email alone.
• Messages from executives that are out of character, use personal email addresses or ask for secrecy.
• Login prompts that appear unexpectedly or on unfamiliar pages.
• MFA prompts they did not initiate.
• Unexpected file-sharing invitations or attachments.
• Signs their own account may be compromised: sent items they didn't send, new inbox rules, password reset emails they didn't request.

Our phishing training guide for assistants and wire fraud prevention guide go deeper.

How assistants should report

Reporting must be simple, fast and blame-free:

• One channel: a phone number or messaging channel to your security team or IT help desk, plus a "report phishing" button in email where available.
• Immediately: report as soon as something seems wrong, even if unsure.
• Don't investigate alone: don't click further, forward suspicious messages to colleagues or try to "test" a link.
• Tell the manager and the provider: after reporting to security, inform their manager and the provider's account lead.

Make clear that reporting a mistake, such as clicking a link or approving a prompt, is always the right move. People who fear blame delay reporting, and delay is what turns small incidents into large ones.

Containment: what you do

When an incident involves an assistant's account or work, your security team typically:

1. Disables or restricts the account in your identity provider, revoking sessions.
2. Resets credentials and MFA after verifying the assistant's identity through a trusted channel.
3. Reviews sign-in and audit logs for unusual activity.
4. Checks mailbox rules and delegations for malicious forwarding.
5. Isolates devices through device management if malware is suspected.
6. Assesses data exposure and any payments or changes made.

Because accounts live in your identity provider, you can act immediately, without waiting for the provider. That is one reason we recommend client-controlled identities; see our SSO and access provisioning guide.

Working with the provider

The provider has a role in incidents too:

• Notification: the provider should notify you promptly if they learn of an incident affecting your data or accounts, for example through a lost device or an assistant's report.
• Cooperation: the provider helps with interviews, timelines and evidence about the assistant's work environment.
• Continuity: if an assistant's access is suspended during an investigation, the provider helps arrange coverage where possible.
• Remediation: retraining, process changes or, where appropriate, replacement.

Agree notification expectations, contacts and escalation paths in writing before any incident happens. See account management for how ExecWing structures account contacts.

A one-page incident card for assistants

Give every assistant a short card, pinned in their workspace or saved in their notes, that answers the questions they will have in a stressful moment:

• Who do I call first? The security or IT contact, with phone and chat details, including after-hours.
• Who else do I tell? My manager and the provider's account lead.
• What do I do right now? Stop, don't click further, don't delete anything, disconnect from the network if told to.
• What information should I have ready? What happened, when, what I clicked or approved, which accounts or systems were involved.
• What if the request came from an executive? Verify through a known channel, such as a phone number from the company directory or the company chat tool, never by replying to the message.
• What if I made a mistake? Report it immediately. Reporting is always the right move.

Review the card during onboarding and after any change in contacts. A card that is out of date is worse than no card.

Coordinating across time zones

Remote assistants may work hours when your security team is offline. Decide in advance how urgent incidents are handled outside business hours: an on-call security contact, a managed detection provider, or an IT on-call rotation. Make sure assistants know which number to call at any hour, and test it during a tabletop exercise.

Tabletop exercises

A short tabletop exercise is one of the best ways to prepare. Walk through a scenario with the executive, the assistant, the manager, IT and the provider's account lead. For example: "The assistant receives an email that appears to come from the CFO asking for an urgent wire to a new vendor." Ask each person what they would do, in order. Gaps appear quickly: no verification procedure, no after-hours contact, uncertainty about who can freeze a payment. Fix them before a real incident.

After an incident

Every incident or near miss is a chance to improve. Hold a short review without blame:

• What happened, in sequence?
• What helped detect or contain it?
• What slowed us down?
• What will we change: training, procedures, technical controls?

Share lessons with other assistants and teams. Near misses, such as a phishing email an assistant reported before anyone clicked, deserve recognition; they show the system working.

Privacy and fairness

Investigations may involve reviewing an assistant's activity. Follow your policies and applicable laws, including those in the assistant's country, and treat the assistant fairly. Most incidents involving assistants are the result of sophisticated attacks, not misconduct.

A worked example

An executive assistant receives a text that appears to come from the CEO, asking her to buy gift cards for a client event and send the codes. The number is unknown and the tone is unusual. She doesn't reply. She reports it through the security channel, tells her manager and the provider's account lead, and confirms with the CEO through the company's chat tool that the request is fake. Security issues a short alert to other assistants and executives about the scam. In the monthly account review, the provider and the client note the near miss and add the example to the next training session.

Common mistakes

No reporting channel for assistants. They should know exactly whom to call.

Blame culture. Fear delays reporting.

Provider-controlled accounts. You can't contain what you don't control.

No tabletop practice. The first rehearsal shouldn't be a real incident.

Frequently asked questions

Will ExecWing notify us of incidents?

Yes. We agree notification contacts and expectations with each client and notify promptly of anything affecting your data or accounts.

Are assistants trained on security?

Yes, and we encourage clients to include assistants in their own security awareness programs too.

What happens to coverage during an investigation?

Your account lead works with you on coverage options while access is suspended.

Should assistants have access to payment systems?

Only where necessary, with separation of duties and verification procedures. See payment fraud controls.