Phishing attacks have changed. Today's attacks are no longer limited to fake emails and stolen passwords. Attackers use AI to generate highly convincing lures, exploit trusted platforms, steal tokens and sessions, and turn a single successful phish into a full identity compromise.

In this session, we'll follow a real-world phishing incident from the first user interaction through investigation, containment, and recovery. Using lessons learned from customer environments, we'll explore what actually happens after an attacker gains access and how security teams can uncover the full scope of an incident.

We'll trace the attack path across Microsoft 365, following the evidence through email, identities, user activity, and security signals. Along the way, we'll look at how Microsoft Defender, Exchange Online, Entra ID, user reporting, and modern investigation workflows can help defenders understand what happened and respond effectively.

You'll see where traditional assumptions about phishing often break down, why a successful phish is frequently an identity attack rather than an email problem, and how attackers are increasingly leveraging AI-generated content, trusted services, and evolving social engineering techniques to bypass defenses.

We'll also discuss practical response and recovery strategies, including how to identify compromise, contain attackers, reduce persistence, and strengthen defenses to prevent similar incidents in the future.

Whether you're responsible for messaging, identity, security operations, or Microsoft 365 administration, you'll leave with practical guidance, real-world lessons learned, and a better understanding of what modern phishing attacks look like beyond the inbox.

Key Takeaways
Understand how modern phishing attacks evolve from email delivery into identity compromise and account takeover
Learn practical investigation techniques across Microsoft 365, Defender, and Entra ID
Recognize common attacker tactics involving token theft, session hijacking, and AI-enhanced phishing campaigns
Gain actionable response and recovery guidance based on real-world incidents and lessons learned