Phishing Reports & Security Tickets

The warehouse supervisor at Tollgate Foods forwarded the email to the desk with one line: this looks wrong. It was wrong. It was a very good imitation of the payroll provider, sent to forty people. He was the first of three to report it and the only one to say why. The real payroll mail never calls him by his first name. By the time the desk had read his message, two colleagues had already clicked. The desk thanked him first, before anything else. The thanks was the cheapest security control in the building and the one most organisations forget to deploy.

This series is about the security ticket a help desk actually gets, which is mostly a person saying this looks wrong. It covers the user-reported suspicious email and why it is the best early-warning signal the desk has. It covers the phishing triage flow in plain words, deciding phishing, spam or legitimate without a forensics degree. Then comes when someone clicked, and the first hour that limits the damage without blaming anyone. It covers rewarding the reporters, because a culture that reports more clicks less. It covers the other security tickets a desk will see, from the found USB stick to the odd sign-in alert. And it covers measuring reports and clicks without shaming anyone, which is the only way the numbers stay honest.

Articles in This Series

• The User-Reported Suspicious Email: Your Best Early Warning
  Why a user's report is the best early-warning signal a desk has, and the one-button or forward-to-a-mailbox channel. Covers what to say to the reporter within the hour, the desk's role, and the acknowledgement.
• The Phishing Triage Flow: Phishing, Spam or Legitimate
  Phishing, spam or legitimate; sender mismatch and where the link really goes in plain words; the did-you-click question asked kindly; three reports of one message; escalating; and the triage card.
• When Someone Clicked: The First Hour After a Phishing Click
  The password reset, session revocation in plain words, the device check, telling the security function, the kind conversation, the note without blame, and the clicked runbook.
• Rewarding the Reporters: The Thank-You That Stops the Next Click
  The thank-you every time, the monthly note of what the reports caught, the no-blame rule kept, the leaderboard question handled carefully, and the thank-you message.
• Other Security Tickets the Desk Will See, and Who It Tells
  The odd sign-in alert, the found USB stick, the lost badge, the account doing things, the tailgater, the suspicious call. Covers what the desk does first and who it tells, and the routing table.
• Measuring Reports and Clicks Without Shaming Anyone
  Reports per month, time to acknowledge, the click rate as a worked example, and the trend over a year. Covers the line in the leadership report, never a per-person list, and the monthly line.

Explore More Topics

This series is part of the QuerySolv helpdesk topic library. It covers the foundations, processes, communication, knowledge, tooling, metrics, classic ticket domains, people and strategy behind a support desk that works. The library pairs well with the software we build: QuerySolv. It is a self-hosted help desk that runs as one Windows service on your own network. It is licensed once per installation, not per agent per month.