How do we communicate during an incident if our e-mail may be compromised?
Move the incident discussion to a channel the attacker cannot read before you say anything about your plans. Attackers who control a mailbox or the directory often read the response team's messages and adapt. Agree in advance on an out-of-band channel: phone calls, a messaging group on devices that do not use company accounts, or a separate collaboration space with its own logins. Keep a printed contact list, because the address book may be unavailable. Ask your insurer, bank and key customers to confirm any request from you by phone, because criminals sometimes send fake messages in the middle of an incident. Once the directory and mail are rebuilt and credentials reset, move back. NetSenX alerts live in their own dashboard, which you can open from a clean device, so the network picture does not depend on company e-mail.