Imagine you’re working your way through a queue of security alerts when a report comes in from accounts payable. A supplier has asked to update its bank details ahead of an invoice due date. The company name is correct, and the email sits inside what appears to be an existing thread. The only thing that caught the clerk's attention was that the new account didn't match the one on file, so instead of approving the payment, they confirmed with the supplier through a known contact and forwarded the message to you.
On its own, the report is a near miss. For your team, it’s also a lead. Someone outside the organization knows who your suppliers are, when invoices fall due, and how payment changes get processed. The same message, or a variant of it, may be sitting in other inboxes where no one reported it. Once you pull the headers, search mail logs for the sending infrastructure, and look for lookalike domains, that single report can show how an attacker is mapping your finance workflows and where your filters let them through.
Data collected over time can expose patterns that are hard to recognize from just one inbox. The UK's National Cyber Security Centre (NCSC) has received more than 10.9 million submissions through its Suspicious Email Reporting Service in the year covered by its 2025 annual review. Those reports helped identify scams for removal. Inside an organization, reporting can provide similar early warnings and actionable insights.
Hoxhunt's 2026 threat intelligence report on the cyber threat landscape examines malicious emails that employees flagged after they had passed security filters. Its findings draw on attacks recorded from January through June 2025, with comparisons to earlier years. These signals reveal where initial detection missed suspicious messages, giving IT teams specific cases to investigate.
In the analysis, researchers observed phishing sent through Salesforce's mailing infrastructure. Salesforce-associated domains rose from 0.6% of malicious sender domains in January to 1.8% in June within the sample. This means a familiar sending service or ordinary-looking attachment can be enough to deliver a fraudulent request to an employee's inbox. These aren't necessarily cases of domain spoofing either. The service itself may be legitimate, and attackers are able to find ways to use recognizable infrastructure to deliver malicious content.
Apart from the message itself, documents can also be attack vectors. In the first-half 2025 sample, PDFs accounted for 23.7% of attachment-based phishing. These documents can contain links to credential-harvesting pages such as a spoofed payment-processor login page. If an employee reports an invoice that unexpectedly demands a login, an analyst can investigate the destination and search for related messages.
Several similar reports might justify closer inspection of how attachments can be abused for fraud. Security controls can then be adjusted based on what employees actually received.
A message may look credible until you examine its technical details. An employee expecting a certain document has every reason to read and act on it, especially if it is part of their routine work. The person may focus on finishing the task if it seems routine enough, without questioning the sender, the message, or any attached documents.
In one case cited in the research, an email arrived with a conversation thread that appeared to include a message from the CEO. This is included by malicious actors to add legitimacy and a sense of urgency. A recipient might feel uncomfortable questioning decisions that appear to have come from the top, particularly when payment is already overdue.
This scenario could uncover a weakness in the approval process. Does finance require confirmation regarding changing banking instructions using a contact already on file? Can staff pause a payment without being penalized for holding it up? If this pretext keeps recurring, the organization will need a clearer procedure that offers more protection than just another general phishing reminder.
Employee behavior is part of the evidence, too. In separate phishing simulations discussed in the research, familiar file-sharing and calendar requests drew greater engagement from employees. That helps explain why ordinary tasks have become effective cover for phishing attacks beyond the usual person-to-person email. Reports that capture what the recipient was doing and what prompted suspicion can provide more relevant training examples than a basic report with a screenshot or a fraudulent link.
Read in aggregate, months of reports can surface changes too gradual to notice in any single message. The 2026 report found that malicious SVG attachments made up 5% of attachment-based phishing in the first half of 2025, up from a negligible share in 2024. While QR-code phishing had fallen from its 2023 peak, these codes still appeared inside PDFs, where ordinary text inspection might miss them.
It's worth checking whether similar files are showing up in your own reports, especially from teams that exchange documents often. An unfamiliar format may justify adjusting the way attachments are inspected. It could also help improve and update employee training strategies. Reports help bring those changes to light before they become part of the routine process, in which case they could already widen the attack surface.
Reports can also bring to light how an attack's starting point can change. For instance, the research documented fake account-suspension notices that led people managing business social media profiles into fraudulent support chats. In such a scenario, a marketing employee trying to restore access may receive a fraudulent alert through a chat message but not through email.
If reporting covers email alone, an attack that arrives by chat may never reach the security team. Messages from workplace chats and social platforms need a reporting route for other channels that are part of the job.
[RELATED: The 20-Minute Call: Fake IT Support Hits 30% of Orgs on Teams]
Across thousands of incidents, employee reports can reveal patterns that individual alerts miss. Repeated attempts to alter payment details may point to weak approval procedures. A run of malicious attachments could expose gaps in inspecting beyond emails and other communication channels. NIST's updated incident response guidance emphasizes learning from incidents to improve cybersecurity risk management. The question for IT is whether those findings led to changes that address the weaknesses.
Report counts alone can be misleading. More telling is what the reports uncovered, how promptly they were investigated, and whether the findings helped prevent a repeat. Employees should also hear back when possible, including when a message proved harmless or if it helped fend off an actual attack. If reporting disappears into a queue without feedback, useful observations may not reach the team next time.