When Your Email Goes Down, Does Your Incident Response Go With It?

When Microsoft 365 went down on Nov. 12, many security teams lost more than email. Outlook, Teams and Copilot failed for hours. So did Microsoft Defender, Purview, Intune and the Microsoft 365 admin center, ABC News reported. Outlook problem reports on Downdetector peaked near 140,000. Microsoft traced the disruption to servers that were overwhelmed after a network configuration change. The company said it found no sign of malicious activity.

For CISOs, the outage exposed a flaw built into most incident response plans: the response runs on the same platform it is meant to protect. When that platform fails, the response fails with it.

An outage is an incident until proven otherwise

Microsoft said it saw no malicious activity, but every security team still had to make its own call. Some had to make it without their own detection and endpoint tools because those tools were also down.

The attackers were expected to move quickly. ING and other firms warned customers about fake “IT help” calls during the disruption, and experts expected phishing to rise once delayed email started arriving, Microsoft extended email delivery timeouts to 48 hours so messages would not be lost. That means a large backlog lands all at once, which is an easy place to hide a malicious message.

The cause of an outage does not decide whether it becomes a security incident. Attackers do. A configuration error creates the opening: employees who expect a call from IT, a backlog of unscreened email and security tools that may be offline. Criminals do not have to cause an outage to exploit it. Whether one turns into a breach depends on how fast someone exploits the confusion, and how fast the response team notices.

Backup comms keep people talking, not the response running

Most mature security programs have a fallback: a WhatsApp group, a conference bridge, a phone tree. Those keep people talking. They do not keep the incident response team running.

When responders move to personal phones and improvised group chats, they lose the playbook, the task list, the owner of each action and the timestamped record of who decided what, and when. That record is not paperwork. It is the evidence regulators, auditors and plaintiffs will ask for.

The deadlines do not pause. U.S. public companies must file a Form 8-K within four business days of determining that an incident is material, and the SEC expects that determination to be made “without unreasonable delay.” The EU’s NIS2 directive requires an early warning within 24 hours of becoming aware of a significant incident.

Piecing together a timeline from text messages after the fact is slow, incomplete and hard to defend. A phone tree restores the conversation. It does not restore command.

Move the response, not just the conversation

Many organizations have answered this risk with an out-of-band war room: a separate site or channel that holds playbooks, contact lists and documents in case corporate systems fail. That beats nothing, but it is not enough.

A war room stores the plan. It does not run it. Responders still have to assign tasks, track who owns each action, log decisions with timestamps, coordinate legal and communications work, and meet notification deadlines. If that work happens in a static folder and a group chat, the incident record breaks apart the moment the team leaves the corporate platform.

“An out-of-band war room is not an incident response capability,” said Matt Hartley, co-founder and chief product officer of incident response company BreachRx, when BreachRx expanded its platform in October.

The goal is to move the response itself out of band: the workflow, the task assignments, the decision log and the regulatory obligations, all in one environment that stays up when the corporate stack goes down.

The underlying problem is concentration. Over the past decade, organizations have consolidated  email, identity, collaboration, endpoint security and compliance onto a single vendor to save money and simplify operations. CISOs inherited the result: one provider whose failure takes down both the business and the tools that defend it.

Outside providers now cause most visible disruptions. Uptime Institute found that cloud, internet, telecom and colocation providers account for about two-thirds of publicly reported outages it has tracked over nine years. In its latest survey, 57% of organizations said their most recent major outage cost more than $100,000, and 1 in 5 said it cost more than $1 million, according to the 2026 Annual Outage Analysis.

That makes incident response resilience a risk question for the board, not only for IT. Four questions every CISO should be able to answer:

• Can the response team reach its playbooks, contacts and task assignments if Microsoft 365 is unavailable?
• Does the fallback environment use identity separate from corporate single sign-on?
• Will decisions made during an outage be captured, with timestamps, in one system of record?
• Has the team run a tabletop exercise that assumes the primary platform is offline?

A free rehearsal

Microsoft says this week’s outage was not an attack, which made it a free rehearsal. Many organizations found that their incident response plan had the same single point of failure as everything else, and that their fallback was a phone tree and a shared folder.

Out-of-band incident response is more than backup chat and a place to keep files. It takes an integrated cyber incident response management platform that runs outside the corporate stack and keeps communications, tasks, playbooks, decisions and evidence in one record.

BreachRx built its Rex Platform for that purpose. Its Out-of-Band Comms solution gives response teams secure email, chat and meetings outside corporate systems, connected to the same workflows, obligation tracking and incident record they use in Rex. Teams can set up participants and permissions in advance and rehearse in the environment before they need it.

The next outage may not come with assurance that no one is inside. BreachRx offers CISOs an out-of-band incident response readiness assessment that shows where their response would stall if the primary platform went dark.

Request a demo to learn how your incident response team can stay coordinated when primary systems are unavailable.