At 3pm in Track One, we've got Kelsey O'Connell presenting "It Wasn’t Spoofed: Investigating Authenticated Email Abuse in Real Environments". "A suspicious email spreading internally was initially attributed to spoofing after a user reported a message sent from their account that they had not sent. However, analysis revealed the message originated from within the organization. Authentication had succeeded, the message was treated as internal, and no alerts were generated. The activity was not spoofing, but authenticated abuse using valid credentials. This session walks through how to investigate and differentiate between spoofed and authenticated activity, and what control gaps allow this type of behavior to persist in real-world environments."