First thing you do every office day is to check your email inbox. One morning, you received an email from your best friend and the subject line is quite strange. What should you do?

Simply deleting the email fails to report a potential security incident, leaving the organization unaware of a possible compromise or phishing campaign.

A supervisor is not the designated handler for security incidents; escalation should go directly to the security response team, not management.

Forwarding the suspicious email to the company's security response team preserves evidence and allows trained analysts to investigate a potential phishing or account-compromise incident. Permanently deleting the email afterward prevents accidental interaction with any malicious links or attachments. This follows NIST SP 800-61 incident handling best practices by escalating to the appropriate response team.

Replying to the sender could confirm the email address is active to an attacker, and may trigger further phishing attempts or expose additional information.