--- title: What happens if we have a compromised account? description: What happens if we have a compromised account? --- [Skip to content](https://knowledgebase.cybernut.com/cybernut-knowledge-base/what-happens-if-we-have-a-compromised-account#main-content) English Show submenu for translations [![Help Center Banner-2](https://knowledgebase.cybernut.com/hs-fs/hubfs/Help%20Center%20Banner-2.png?width=400&height=150&name=Help%20Center%20Banner-2.png)](https://knowledgebase.cybernut.com/cybernut-knowledge-base?hsLang=en) - [Home](https://www.cybernut.com/) - [Platform](https://www.cybernut.com/platform) - [Resources](https://www.cybernut.com/resources) Open main navigation Close main navigation - [Home](https://www.cybernut.com/) - [Platform](https://www.cybernut.com/platform) - [Resources](https://www.cybernut.com/resources) - English Show submenu for translations - [Contact Us](https://www.cybernut.com/contact) [Contact Us](https://www.cybernut.com/contact?hsLang=en) How can we help you? - There are no suggestions because the search field is empty. 1. [CyberNut Knowledge Base](https://knowledgebase.cybernut.com/cybernut-knowledge-base?hsLang=en) 2. [Admin Portal](https://knowledgebase.cybernut.com/cybernut-knowledge-base/admin-portal?hsLang=en) September 22, 2026 # What happens if we have a compromised account? The **Compromised Account** feature is available as part of the standard license plan for partners at no additional cost. Below is a walkthrough on how it works.   **Details** - **Account compromise detection**: when several reported emails trace back to the same internal sender and are also determined to be phishing attacks, CyberNut flags the user account and alerts your admins, catching account takeovers in minutes - **Automatically suspend** user accounts as soon as our system detects a potentially compromised account to ensure the account doesn’t have an opportunity - **Auto-quarantine emails** across other inboxes with Advanced Threat Search (ATS)to catch all the emails even if they haven’t been reported yet **Q: Is the compromised account flag based on volume of emails sent or volume of recipients?** A: A compromised account detection requires 3 conditions to be true: 1. The email has been reported with the CyberNut Reporting Tool. 2. The reported email comes from an internal sender. 3. The email is scanned by AI-enabled threat manager (technically its ATT) and has a verdict of phishing (score does not matter). **Q: What does the end user see if their account is auto suspended?** A: The end user will not be able to login. **Q: Are there are any wait/lag times when account is deactivated or reinstated?** A: De-activated is instantaneous when score is computed and email is Phishing, re-instated is a manual action from IT admin so latency is not predictable. **Q: Do they get the password reset flow with either reinstate option?** A: At the time of re-instate action we show the new password to IT Admin, they can share with the user. If an email is compromised it will appear in this area. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Jul-07-2026-08-29-31-8391-PM.png?width=670&height=241&name=image-png-Jul-07-2026-08-29-31-8391-PM.png) Click an email to see more details. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Jul-07-2026-08-33-00-3285-PM.png?width=670&height=386&name=image-png-Jul-07-2026-08-33-00-3285-PM.png) Here you can see details such as score, status, subject, reports, verdict and last reported. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Jul-07-2026-08-34-02-4986-PM.png?width=670&height=262&name=image-png-Jul-07-2026-08-34-02-4986-PM.png) Click the row and more details will appear that you can further investigate. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Jul-07-2026-08-36-07-9054-PM.png?width=670&height=317&name=image-png-Jul-07-2026-08-36-07-9054-PM.png) If an email is compromised you will receive an email similar to this one below if you have entered an email in **Settings\>Add on** to receive CyberNut Alerts. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Jul-16-2026-01-15-44-6707-PM.png?width=670&height=184&name=image-png-Jul-16-2026-01-15-44-6707-PM.png) ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Jul-16-2026-01-17-57-3277-PM.png?width=670&height=333&name=image-png-Jul-16-2026-01-17-57-3277-PM.png) Select **ATT recommended actions**. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Aug-07-2026-02-19-37-4979-PM.png?width=670&height=276&name=image-png-Aug-07-2026-02-19-37-4979-PM.png) Here are some recommendations for dealing with the compromised account. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Aug-07-2026-02-21-00-0771-PM.png?width=670&height=234&name=image-png-Aug-07-2026-02-21-00-0771-PM.png) Select **Key Evidence.** ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Aug-07-2026-02-21-39-5881-PM.png?width=670&height=276&name=image-png-Aug-07-2026-02-21-39-5881-PM.png) This will display the reasoning for the compromised account. ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Aug-07-2026-02-22-43-4031-PM.png?width=670&height=261&name=image-png-Aug-07-2026-02-22-43-4031-PM.png) After following the recommended steps to protect the account, you can reinstate the account by going to the button labeled **Reinstate Account.**  Then select **Reinstate (Case Solved)** or **Reinstate (False Positive)** ![](https://knowledgebase.cybernut.com/hs-fs/hubfs/image-png-Aug-07-2026-02-28-33-1374-PM.png?width=670&height=330&name=image-png-Aug-07-2026-02-28-33-1374-PM.png) The following scopes should be added for Google users. This [article](https://knowledgebase.cybernut.com/cybernut-knowledge-base/compromised-settings?hsLang=en) will walk you through the steps. [https://https://www.googleapis.com/auth/admin.directory.user https://https://www.googleapis.com/auth/admin.directory.user.security](https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/gmail.modify,https://mail.google.com/)   - [Getting Started for IT Admins (Google)](https://knowledgebase.cybernut.com/cybernut-knowledge-base/getting-started-for-it-admins-google?hsLang=en#main-content) - [Getting Started for IT Administrators](https://knowledgebase.cybernut.com/cybernut-knowledge-base/getting-started-for-it-admins-google?hsLang=en#getting-started-for-it-administrators) - [Getting Started for IT Admins (Microsoft)](https://knowledgebase.cybernut.com/cybernut-knowledge-base/getting-started-for-it-admins-microsoft?hsLang=en#main-content) - [Getting Started for IT Administrators](https://knowledgebase.cybernut.com/cybernut-knowledge-base/getting-started-for-it-admins-microsoft?hsLang=en#getting-started-for-it-administrators) - [New & Updated Features](https://knowledgebase.cybernut.com/cybernut-knowledge-base/new-updated-features?hsLang=en) - [Admin Portal](https://knowledgebase.cybernut.com/cybernut-knowledge-base/admin-portal?hsLang=en#main-content) - [Creating Campaigns](https://knowledgebase.cybernut.com/cybernut-knowledge-base/admin-portal?hsLang=en#creating-campaigns) - [Analyzing Campaigns](https://knowledgebase.cybernut.com/cybernut-knowledge-base/admin-portal?hsLang=en#analyzing-campaigns) - [Reported Threats](https://knowledgebase.cybernut.com/cybernut-knowledge-base/admin-portal?hsLang=en#reported-threats) - [Troubleshooting/FAQs](https://knowledgebase.cybernut.com/cybernut-knowledge-base/troubleshooting-faqs?hsLang=en#main-content) - [General Questions](https://knowledgebase.cybernut.com/cybernut-knowledge-base/troubleshooting-faqs?hsLang=en#general-questions) - [Google](https://knowledgebase.cybernut.com/cybernut-knowledge-base/troubleshooting-faqs?hsLang=en#google) - [Microsoft](https://knowledgebase.cybernut.com/cybernut-knowledge-base/troubleshooting-faqs?hsLang=en#microsoft) - [Admin Portal](https://knowledgebase.cybernut.com/cybernut-knowledge-base/troubleshooting-faqs?hsLang=en#admin-portal) - [Faculty and Staff User Guides](https://knowledgebase.cybernut.com/cybernut-knowledge-base/faculty-and-staff-user-guides?hsLang=en#main-content) - [Faculty & Staff Guides](https://knowledgebase.cybernut.com/cybernut-knowledge-base/faculty-and-staff-user-guides?hsLang=en#faculty-staff-guides) - [Technical Support](https://knowledgebase.cybernut.com/cybernut-knowledge-base/technical-support?hsLang=en) [![Logotype Main@4x-1](https://knowledgebase.cybernut.com/hs-fs/hubfs/Logotype%20Main@4x-1.png?width=100&height=27&name=Logotype%20Main@4x-1.png "Logotype Main@4x-1")](http://cybernut.com?hsLang=en) Copyright © 2025, cybernut.com