IRONSCALES Phishing

Triage IRONSCALES, the mailbox-level anti-phishing platform — the vendor specialization of
security-alert-response and phishing-triage, which own the canon. Two things define it:
detection sits inside the mailbox, so it sees post-delivery threats and can remediate across
every affected inbox at once, and its in-mailbox banner lets users report suspected phishing
in one click, producing a stream of employee reports of varying quality. You have no
IRONSCALES console — remediation, classification changes and tenant purges are technician
steps you direct and record.

1. Parse the incident: classification (phishing, malicious, suspicious, spam, safe), the
   themis/AI confidence signal, sender and authentication results, URLs and attachments, the
   number of affected mailboxes in the campaign cluster, and the remediation state —
   auto-remediated (pulled from inboxes), pending analyst decision, or report-only. Copy
   IRONSCALES' exact wording. Route to the client per security-alert-response on the tenant
   or domain fields; low confidence means flag for a human.

2. Use the mailbox-level advantage: IRONSCALES clusters the same campaign across every
   recipient, so confirm the reach — did the pull cover all clustered mailboxes, or only
   some? Reach is a claim until confirmed, and a partial pull leaves live copies. Any
   un-remediated recipient is live: check interaction (click, reply, credential entry) per
   phishing-triage. Delivered and clicked on credential harvesting →
   compromised-account-containment for that user. Interaction opens the identity path whether
   or not the message was later remediated.

3. Triage banner-reports proportionately. A user report is a signal, not a verdict: classify
   on evidence, not on the reporter's alarm — but never dismiss one silently, because the
   classification trains the model and shapes the user's future reporting. These reports are
   a security asset: a true positive gets remediated tenant-wide and the
   reporter acknowledged; a false alarm gets a clear, kind explanation.

4. Scope beyond the cluster: check prior tickets for the same client and sender or URL over
   roughly 90 days for the same actor behind earlier campaigns.

5. Keep classification discipline: marking a message safe or malicious in IRONSCALES feeds
   the AI, so hold a "safe" verdict to the same evidence bar as closing the ticket. Never
   mark a message safe to quiet a frequent reporter — it mistrains the model and blinds the
   desk to the next real one.

6. Note the classification, the remediation reach, the interaction check and the
   report-triage outcome; classify per soc-classification-tree. Client-facing wording per
   defensive-writing-standard.

Without documentation the client's mailbox scope and licensed features may be unknown — say
so. Never invent data; when in doubt do nothing irreversible and escalate.