Before
Support had to coordinate endpoint isolation, session revocation, and device locking across separate consoles before assembling the evidence for Security. Staff then had to request a replacement, communicate with the employee, track the SecOps decision, and update the incident manually.
How it works
- Receive the lost-device incident, acknowledge it, and coordinate reversible containment while notifying the employee and requesting a replacement.
- Assess the supplied exposure evidence, document the findings, and ask SecOps whether to wipe or keep the device locked.
- Apply the approved wipe or enterprise-data retirement action, communicate the result, and close or escalate the incident with a recorded audit trail.
Workflow details
- Incident intake and acknowledgement: The workflow receives the lost-device incident, updates its priority and status, records that containment is starting, and keeps the incident associated with the affected user and device.
- Immediate reversible containment: When the relevant device and user identifiers are available, it coordinates endpoint isolation, session revocation, and device locking before any irreversible action. The employee receives a containment notification and a replacement device request is created.
- Exposure assessment: The workflow evaluates the supplied device, endpoint, and sign-in evidence using configured rules for ownership, encryption, compliance, recent presence, and suspicious activity. It records the exposure level, recommendation, limitations of the assessment, and any need to involve the DPO when encryption is not confirmed.
- SecOps decision and safeguard: SecOps receives the evidence and can approve a wipe or keep the device locked; if no response arrives within four hours, the device remains contained and the incident is routed for follow-up. The workflow does not perform the irreversible action until the decision is received.
- Resolution and communication: For an approved action, the workflow wipes a company-owned device or retires enterprise data when the device is personal or ownership is not confirmed. It updates the incident with the decision and next steps, notifies the employee, and closes or escalates the record according to the outcome. The demonstration uses synthetic observations and simulated integration responses.
What changed
Containment now starts from the incident and is coordinated automatically before the wipe decision. SecOps retains approval of the irreversible action, while the workflow handles the evidence handoff, replacement request, employee updates, incident documentation, and final routing.
Work removed
Manually coordinating endpoint isolation, session revocation, and device locking; compiling device, security, and sign-in evidence; requesting a replacement; notifying the employee; and copying the SecOps decision and next steps into the incident.
Expected outcome
Each eligible incident can remove at least three separate containment actions from the help desk process while preserving a four-hour SecOps decision window and a documented final handoff.
