Feedback

Once the attack has been contained and depending on the scale, it may be interesting to carry out a RETEX to see the possible points of improvement (are the staff sufficiently trained? Was access to the mail servers ok? Are the query commands documented? etc.).