Beyond Click Rates: Build a Phishing-Reporting and Escalation Workflow

A low click rate on your phishing simulations looks good in a report. It doesn't tell you what happens when a real message lands and someone says, "this looks odd."

The better questions are whether an employee can report it fast, and whether the right person handles it the same way every time.

Give Users One Reporting Path

Choose one primary method that's easy to find: a report button in the mail client, or a dedicated security mailbox. Then say what's worth reporting:

• Unexpected sign-in or password requests
• Changes to payment or banking details
• Urgent requests that skip the normal process
• Unfamiliar attachments or file-share notifications
• MFA prompts the person didn't start
• Messages pretending to be a boss, vendor, or customer

Don't ask people to prove a message is malicious. Their job is to raise the flag. Investigating belongs to the response team.

Capture the Right Context

A screenshot often drops the sender, routing, link, and attachment details, so the report should carry the original message. At intake, find out:

• Who reported it and when it arrived
• The original message or attachment
• The claimed sender and the business context
• Whether the person clicked, opened, replied, or typed anything in
• Whether money, credentials, or sensitive data are involved

Make it safe to admit a mistake. A report that arrives three days late leaves you guessing.

Set Triage Levels

Keep the categories simple enough to remember.

Routine review

A suspicious message was reported, nobody interacted with it, and there's no sign it went to others.

Urgent investigation

A link was opened, an attachment ran, credentials may have been entered, or the message reached several people.

Critical escalation

A payment instruction is involved, an account is confirmed compromised, sensitive data was disclosed, malware is active, or a campaign is hitting the whole business.

Say who owns each level and what response time you expect internally. Don't build it around one person who might be on vacation.

Build a Containment Checklist

Whoever responds shouldn't have to invent the process mid-incident. Depending on what happened, the checklist might say:

1. Preserve and analyze the message.
2. Search other mailboxes for similar messages.
3. Remove or quarantine confirmed malicious copies.
4. Block the sender, domain, link, or file where appropriate.
5. Reset credentials and revoke sessions if compromise is suspected.
6. Review sign-in, mailbox, and forwarding activity.
7. Isolate affected endpoints if needed.
8. Notify finance, leadership, privacy, or other owners depending on impact.

Put the business steps and technical steps in the same runbook, so nobody assumes the handoff happened.

Communicate Without Adding Noise

If a campaign hits several people, send a short internal alert with details they'll recognize and what to do. Don't forward the live malicious message as an example.

If the message pretends to be a real vendor or executive, agree on an approved channel before you contact anyone outside.

Close the Loop

People report more when they see that it matters. Acknowledge the report, share a simple outcome where it's appropriate, and say thanks. Then log the detection source, what the user did, the scope, containment steps, escalations, and any lessons or control changes.

Look beyond clicks. Track how many reports come in, how fast, how many were actionable, whether containment was completed, what themes repeat, and what follow-up work is still open.

You won't get perfect judgment from every employee. A reporting process that people trust turns an early hunch into fast action with someone accountable.

Related Reading

This builds on our spear-phishing guide. Spotting an attack matters, and so does reporting it quickly enough for someone to contain it.