In the rare instance that an employee does interact with a phishing email and falls victim to an account compromise, ATO now helps surface those emails directly in the Case timeline—highlighting up to five messages that likely contributed to the breach.

This enhancement provides deeper context for investigations, giving security teams a clearer understanding of how access was gained and when. It also helps uncover potential patterns that may indicate a larger campaign targeting other employees.