AegisAI Perspectives · 123
Automate user-reported phishing triage as one loop: one report button, grouped reports, an automated verdict, a reply to the reporter, removal everywhere.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Not ready for a demo? Check your domain (free, about 10 seconds).
Automate the abuse mailbox as one loop: intake, grouping, verdict, a reply to the reporter, then removal from every mailbox. Manual triage can take up to 30 minutes for each user-reported alert2. AegisAI investigates every email for what it is trying to do and removes the ones that fail from every mailbox they reached23. If you run IT for a company of 20 to 500 people on Microsoft 365 or Google Workspace, with a lean IT or security team and no SOC, set the loop up in the order below.
Reports keep arriving because filters miss mail: AegisAI research found 3 in 10 confirmed phishing emails cleared native Gmail and Microsoft filters in Q3 202624. That figure sits on the inbound email security page. For the hours this saves an analyst team, read how to reduce SOC time spent on phishing triage. This page stays on the mailbox workflow itself.
Here is the order, with the platform setting or action that drives each stage.
Pick one report button. Running Microsoft and non-Microsoft report buttons together is discouraged, because duplicate submissions create noise6.
Choose where reports land. In Microsoft 365, admins send user reported messages to the reporting mailbox only, to Microsoft only, or to both5.
Keep the original message intact. A non-Microsoft tool must attach the reported message as an uncompressed .EML or .MSG file, not just forward it8.
Group duplicate reports. When several users report the same or similar messages, Microsoft correlates all of them into one incident7.
Let automation close the clean ones. The AIR playbook resolves submissions where no action is needed, which is frequent for user reports9.
Reply to the reporter. A notification can go to the user who reported the message, based on the AIR verdict10.
Remove the message from every mailbox that got it, then check the action finished.
Write these seven stages into your runbook before you change a single setting.
Short on time? Watch the explainer, or book a demo.
A plain forward is not enough: the reported message must arrive as an .EML or .MSG attachment. Two buttons send the same message twice and split one attack into two cases.
Route reports to the mailbox, to Microsoft, or to both. Sending to both keeps a copy in your own mailbox for the record.
Remove the second report button from Outlook today if you run two.
In Microsoft 365, the user reported message settings can email the reporter a result based on the verdict.
The reply waits for the work to finish in one case. For high confidence phishing or malware, the notification goes out only after the investigation closes as Remediated or Partially remediated11. A false alarm gets a fast reply; a real attack gets a reply once the mail is gone.
Turn on the reporter notification and write the three reply texts: clean, spam and phishing.
Automation proposes, and a person approves the actions that change mailboxes. AIR results can include recommended remediation actions that a security operations team must approve12.
Know the ceiling: the maximum number of active, concurrent email remediations is 50, and no new ones start until some finish13. A large campaign can queue behind it.
Soft delete is the safe default, because a soft deleted message is recoverable by the user and admins14.
Microsoft's own triage agent has a price of entry: Security Copilot capacity in Security Compute Units, plus Defender for Office 365 Plan 24. When the agent runs, it classifies false alarms as False Positive and resolves them.
Keep one human step for any reporter who clicked a link or typed a password: reset the account before you close the case.
Google Workspace runs the same loop with two tools. In the alert center, the User-reported phishing alert offers two recommended actions: Delete message and Restore message17.
The investigation tool finds every user in the domain who received the message15. Its delete action removes messages that match the message ID and owner, and erased messages stay subject to Vault retention rules and holds.
Check your edition first. Gmail log events are available only with Frontline Plus, Enterprise Plus and Education Plus18.
Confirm your edition shows Gmail log events before you plan removal around the investigation tool.
| Stage | Automate | Keep with a person | AegisAI |
|---|---|---|---|
| Intake | One report button and one mailbox | Choosing the button and the route | Investigates every email, not only reported ones |
| Grouping | Correlation of similar reports into one incident | Merging cases the tool split | One bad email is pulled from every inbox it reached |
| Verdict | Auto resolution when no action is needed | Approval of recommended remediations | Every verdict comes with its reason in plain language |
| Reply to the reporter | Notification based on the verdict | Reply texts and their tone | No edge. Its live pages describe no reporter reply |
| Removal | Delete by message ID across recipients | Large campaigns past 50 concurrent remediations | Removed from every mailbox it reached within seconds |
The reply row is the honest gap: keep your platform's reporter notification on. Fill this table for your own tenant before you buy anything.
One bad email is pulled from every inbox it reached, forwards included. Every verdict comes with its reason in plain language, so your team can check it and share it. The median verdict takes 1.9 seconds, and a convicted message is removed from every mailbox it reached within seconds.
Illustrative example, figures are fictional: Larkfield Studio (fictional) has 140 people on Google Workspace and one IT manager. At 09:40 a message titled "Shared invoice" arrives with a sign-in link. Six people report it within 20 minutes, and the alert center raises one User-reported phishing alert. The IT manager opens the investigation tool and finds 38 recipients. She deletes the message by its message ID, checks the Vault hold note, and sends each of the six reporters the same phishing reply. One reporter typed a password on the link page. She resets that account and closes the case at 10:25.
Time your own next report from first click on the report button to removal.
Track three numbers, each from a log you already have.
For time to detect and time to respond across all email incidents, use email security metrics: MTTD and MTTR.
Put the three numbers next to the 30 minute manual figure on day 30 and decide what to automate next.
Send every report through one button to one mailbox, let the platform group duplicates, auto resolve clean reports, reply to the reporter and remove the message everywhere. AegisAI investigates every email and removes the ones that fail from every mailbox they reached.
In Microsoft 365 they go to the reporting mailbox, to Microsoft, or to both, as the admin sets. In Google Workspace, a report raises a User-reported phishing alert in the alert center.
No. Running Microsoft and non-Microsoft report buttons together creates duplicate submissions and noise. Pick one, and make sure a non-Microsoft button attaches the original as an .EML or .MSG file.
Yes. Microsoft 365 can email the reporter based on the AIR verdict. For high confidence phishing or malware, that email waits until the investigation closes as Remediated or Partially remediated.
Not always. A soft deleted message is recoverable by the user and admins. In Google Workspace, erased messages stay subject to Vault retention rules and holds.
