If you have done the awareness training properly, you have created a new problem: a queue of reported emails, most of them harmless, each one demanding a verdict. The skill of phishing triage is not analysing any single email deeply. It is running the queue so the dangerous one gets found fast and the reporter always hears back.
This runbook is written for whoever owns that queue: a SOC analyst, an IT generalist wearing the security hat, or an MSP working a shared inbox.
The ground rules
- Every report gets a verdict and every reporter gets a reply. The reply can be automated and two lines long. A user who reports three times and hears nothing stops reporting, and the fourth email was the real one. Reporter feedback is a security control, not a courtesy.
- Time-box the common case. A routine report should take two to five minutes to verdict. If you are twenty minutes into one email, you are no longer triaging; either escalate it or park it. The queue matters more than your curiosity.
- Triage in a safe place. Verdicts come from headers, URLs and attachments examined in tooling or a sandbox, never from opening things on your own workstation while logged into everything.
The verdict scale
Four verdicts cover everything. Agree them, write them down, and use them consistently so your metrics mean something.
- Clean. Legitimate mail, often marketing or an unfamiliar but genuine sender. Reply, thank, release.
- Spam or grey mail. Unwanted but not malicious. Block sender if persistent, reply, close.
- Phishing. Credential harvesting, brand impersonation, malicious attachment or link. This triggers the response steps below.
- Targeted or high-risk. Spearphish referencing real people, projects or payments; anything aimed at finance or executives; anything that arrived from a genuine compromised counterparty. This escalates beyond the queue, always.
The five-minute assessment
Work the same sequence every time. Consistency is what makes you fast.
- Read the story first. What is the email asking the recipient to do? Urgency plus authority plus an action (click, open, pay, buy vouchers, “are you free?”) is the phishing shape regardless of technical content.
- Check the sender’s real address, not the display name. Look for lookalike domains, freemail addresses behind executive names, and reply-to mismatches.
- Check the authentication results in the headers. SPF, DKIM and DMARC failures on a domain that normally passes are a strong signal. Passes prove little on their own; attackers authenticate their own domains perfectly.
- Examine URLs without clicking. Expand shorteners, read the actual destination domain right to left, and treat redirect chains and open redirects on legitimate services with suspicion. If you must detonate, do it in a sandbox or an isolated VM, never on your daily driver.
- Treat attachments as guilty until proven otherwise. Hash and look up before opening anywhere. HTML attachments, ISO and archive files, and documents demanding macros be enabled carry most of the risk.
- Verdict and move. Write one line of reasoning with the verdict. Future you, three months from now during an incident, needs to know why this was called clean.
When the verdict is phishing: the response steps
A phishing verdict is not the end of the job. The email you were sent is one copy of a campaign.
- Find every other copy. Search the mail platform for the same sender, subject pattern or URL across all mailboxes and purge it. One report usually means ten deliveries.
- Find out who already clicked. Check proxy or DNS logs for the malicious domain, and the mail platform’s URL-click telemetry if you have it. Every clicker gets a password reset and session revocation if credentials could have been entered, and their machine gets a scan if something executed.
- Block the infrastructure. Sender domain and URLs into the mail filter, the proxy and DNS filtering. Note them in the log; they will reappear dressed differently.
- Reply to the reporter with the outcome. “That was a real one, we have removed it from 14 mailboxes, well spotted” costs thirty seconds and buys you the next report.
- Report it beyond your walls where it helps. Impersonated brands, hosting providers and national reporting schemes all take these; takedowns protect the next target and it is community-minded work that costs minutes.
When triage becomes incident
Stop treating it as queue work and declare an incident when any of these are true:
- Credentials were entered on a harvesting page, and the account has anything beyond basic access.
- An attachment executed anything on a machine.
- The mail came from a genuinely compromised internal account, which makes it a BEC, not a phish.
- The same target or theme keeps arriving across days, suggesting a campaign aimed specifically at you.
- Finance, payroll or executive assistants were targeted with payment or gift card instructions that anyone acted on.
The handover is your triage notes: indicators, affected users, clickers identified, actions taken so far. Good triage notes are the difference between an incident that starts at hour zero and one that starts at hour minus-two.
Watch the monthly numbers
Once a month, look at four numbers: reports received, median time to verdict, percentage of reporters who got a reply, and true positives found. The first shows whether people still bother, the second whether the queue is healthy, the third whether you are keeping the bargain, and the fourth justifies the whole exercise. If reports are falling, the queue is quietly dying and the fix is feedback, not another awareness campaign.
One-page checklist
Reply to every reporter. Two to five minutes per routine email. Read the story, check the real sender, check authentication results, inspect URLs without clicking, treat attachments as hostile. Verdict with one line of reasoning. On a phishing verdict: purge every copy, find the clickers, reset and revoke where credentials went in, block the infrastructure, tell the reporter the outcome. Escalate to incident on entered credentials, execution, internal senders, sustained targeting or targeted finance asks. Watch the monthly numbers, especially reports received.
Practitioner Runbooks are working documents, not standards. Spotted something that does not match how it works in your environment? Email hello@incidentresponse.com and we will improve it, credited to you.