Reports suspicious messages

Uses the reporting button or channel whenever a message feels wrong, whether or not they clicked.

Reports turn one person's instinct into an early warning for everyone. In large field studies, employee reporting spotted real campaigns quickly, even when training changed little else.

How to observe it: Suspicious Email Reporting Rate (SERR): reports per simulation and per real phish, and time from delivery to first report.

Supporting evidence

• Phishing reporting in organizations: What motivates employees to take action? Burda et al., 2025
• Phishing in Organizations: Findings from a Large-Scale and Long-Term Study Lain et al., 2022

Context

• "I didn't click": What users say when reporting phishing Pilavakis et al., 2023

Challenging evidence

• Anti-Phishing Training (Still) Does Not Work: A Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale Rozema & Davis, 2026