The SoSafe Phishing Report Button (PRB) is your frontline human-defense tool against cyber threats. Directly integrated in your organization’s email environment, the PRB allows your users to report suspicious emails easily, transforming every employee into a security sensor. The PRB acts as a security coach, providing your users with the tools and insights needed to investigate threats in real-time.
Key features
Reporting reasons & feedback
When an email is reported, users provide your security team with vital context to help accelerate triage.
-
Tailored categories: Users select from a list of reporting reasons (such as "Content”, “Attachment” or “Sender”). These categories help your team prioritize threats based on the reported nature of the risk.
-
Contextual comments: A comment box allows users to provide additional details on why the email appeared suspicious.
-
Admin control: Within the SoSafe Manager, you can determine whether reporting reasons and comment boxes are optional or mandatory, and even define custom reasons to align with your organization’s specific security protocols.
Hints (technical clues)
The PRB looks through the technical structure of an email to help users identify discrepancies, below are some examples:
-
Headers or senders: Identifies if a sender’s display name does not match the actual email address.
-
Links or attachments: Checks links and files to identify technical inconsistencies, for instance when a link's destination does not match its text.
Hints are designed to coach the user toward an informed decision without simply giving the "answer," building better security judgment over time.
AI Hints (tone & content analysis)
While standard Hints focus on technical data, AI Hints utilizes AI to analyze the content and psychological tactics used within an email.
-
Tone & pattern detection: Detects manipulation tactics such as strong urgency, pressure from authority figures, or emotional appeals. Also identifies linguistic patterns to help users recognize the "vibe" of a phishing attempt, even when technical indicators (like links) appear clean.
-
Guided critical thinking: If no malicious patterns are explicitly identified, the AI provides open-ended questions. This guides users to evaluate the email’s context and intent personally, ensuring they think critically before making a final decision.
-
Coaching impact: By highlighting why a message is suspicious, or what to look for when it isn’t, these hints build lasting security instincts that transfer to all areas of an employee's digital work.
Trusted Sender
To reduce "false alarms" and minimize the load on your security team, the PRB recognizes verified internal and partner domains.
-
Reducing friction: When an email originates from a domain your organization has added to its "Trusted" list (via CSV upload in the Manager), a clear indicator is displayed to the user.
-
Verification: This helps users confidently distinguish between legitimate internal communications and spoofed emails.
Integrated Incident Reporting
If an employee realizes they have already interacted with a suspicious email (e.g. clicked a link or downloaded an attachment), the PRB allows them to flag this as a potential security incident immediately.
-
Prioritized Triage: By selecting I interacted with this email, the report is classified as an incident. This allows your security team to prioritize these reports at the top of the list for immediate response.
-
Streamlined workflow: This combines the reporting and incident disclosure process into a single, user-fiendly action.
The user experience
Language & compatibility
The PRB is designed for global organizations and automatically matches the user’s Outlook interface language.
-
The PRB is currently available in over 33 languages (including different locales such as Swiss German, UK-English and US-English).
Closing the loop
After a report is submitted, users see a confirmation screen that shows the information has been sent to the security team.
-
Delete and close: Users have the option to "Delete and Close" the email immediately after reporting. This removes the potential threat from the inbox and ensures the user can return to their workflow safely.
-
Immediate reinforcement: If the reported email was part of a SoSafe phishing simulation, the user receives immediate positive reinforcement, confirming their successful catch and closing the learning loop.