Building a user-reported phishing pipeline that people keep using

Easy reporting

A built-in report button in Outlook or Gmail sends the original message with headers to a monitored mailbox and removes it from the user’s inbox. One click is the goal; anything harder reduces reports. Simulation platforms can route their own test messages separately so they do not clutter real triage.

Automated enrichment

A small automation or SOAR playbook can parse each report, extract sender, URLs, and attachment hashes, look them up in threat intelligence, group duplicates of the same campaign, and open one case per campaign with all reporters attached. Analysts then spend time on verdicts rather than copying data.

• Parse headers, URLs, hashes
• Enrich with reputation and domain age
• Cluster by sender, subject, and URL
• One case per campaign
• Auto-close known simulations

Lab: design the metrics and feedback

Define three metrics for your pipeline and how you would compute them from case data, then write the two feedback messages reporters receive: one for confirmed phishing and one for safe mail. Keep each under four sentences and thank the reporter either way.

metric | definition
report rate | unique reporters / recipients of a campaign
time to verdict | case closed_at - first report received_at (median)
time to purge | purge completed_at - first report received_at (median)

confirmed: Thanks for reporting. This was phishing and we removed it from 37 inboxes. If you clicked the link, contact the help desk now.
safe: Thanks for reporting. This message is legitimate. Reporting when unsure is exactly right.

Keep people reporting

Never punish people for reporting, even if they clicked first; early reports shorten incidents. Share monthly highlights of real campaigns caught through reports, and make sure “I clicked” reports get a fast, calm response.