A practical phishing reporting process
Give staff a clear reporting route and a simple instruction to pause before acting on an unexpected request. The business and IT provider should agree who reviews reports and what happens next.
Minnesota based · Preparing for launch · Scope agreed before work begins
What should employees do with a suspicious email?
Apply the answer to your business
A person who is unsure whether a message is suspicious needs a known contact, not a long technical investigation checklist. Make the reporting path easy to find and explain what information is useful.
This is an illustrative situation, not a reported CX client engagement.
Turn the question into a next action
Choose the business decision you need, involve the person responsible for the system and record what is known versus what needs validation. Keep the follow-up small enough that it has a named owner and a clear finish line.
- Ask your teamWhere should staff report a suspicious message?
- Ask your teamWho reviews reports during normal business hours?
- Ask your teamWhat is the route for an urgent concern outside that coverage?
Evidence to bring to the conversation.
Use the agreed scope to decide which records are relevant. These items can help the business and technical owners establish a common starting point:
- A written reporting route
- Named response responsibilities
- A short staff communication
Missing evidence is an open question to document. It is not a reason to invent an answer or assume that the underlying system is protected.
Know the boundary
Do not forward suspicious attachments or private client information to the CX public enquiry address. For a suspected incident, use your established provider or insurer reporting channel.
Published by CX Cyber Security · General education · Updated October 31, 2026. Further reading: NIST: phishing. CX’s original guide is not a NIST assessment or endorsement.
Plan your next step
Start with the business.
Get clear on the risk.
Tell us what your company does, the size of your team and what prompted your enquiry. We’ll discuss fit and the scope needed before proposing work.
Preparing for launch. Enquiries are welcome; delivery dates and engagements require finalized onboarding and a written agreement. Please do not email passwords or sensitive security evidence.