A phishing report button is a one-click control in Outlook or Gmail that sends a suspicious email - with its full technical headers - to your security contact or your mail provider, without forwarding, copy-pasting or a helpdesk ticket. It is the cheapest control in your security programme and the one with the clearest measurable payoff: organisations with a working button report real phishing in minutes instead of never. This guide covers how to set one up in Microsoft 365 and Google Workspace, what to do with the reports, and how to measure whether it is working.
TL;DR
- The button's job is speed and fidelity: one click, full headers preserved, message pulled from other inboxes.
- Microsoft 365 and Google Workspace both have built-in report buttons that are free - configure them before buying anything.
- Route reports somewhere a human actually looks, and reply to every reporter - an ignored report is the last one you get.
- Track report rate as the headline number; Cyber Aware's benchmark sees monthly programmes climb past 50% by month eight.
- Pair the button with phishing simulations so staff rehearse the exact click on safe emails first.
Why a report button is the highest-leverage control you can add
Most phishing incidents are stopped by an employee's reflex, not a filter. Roughly 60% of breaches involve a human element (Verizon, 2025 DBIR) - which cuts both ways: humans are the attack surface, and a human who reports in thirty seconds is the cheapest detection system you will ever deploy. The Australian Signals Directorate received more than 84,700 cybercrime reports in FY2024-25, about one every six minutes, with an average self-reported cost of $56,600 for a small business (ASD Annual Cyber Threat Report 2024-25) - and the businesses on the cheap end are the ones where the first recipient reported the email fast.
A report button converts every employee from a passive target into a sensor. Without one, the path from "this looks odd" to "the right person saw it" runs through hallway conversations, forwarding to colleagues (which spreads any payload) or silence - and silence is what costs money.
Step 1: Microsoft 365 - the built-in Report button
Microsoft 365 includes a native Report Phishing button in Outlook at no extra cost:
- In the Microsoft Defender portal, open Settings > Email & collaboration > User reported settings, and turn on the Microsoft Outlook report button (or the phishing email button).
- Choose where reported messages go: Microsoft and my reporting mailbox is the recommended option - Microsoft analyses the message for tenant-wide protection while your team sees it too.
- Set the reporting destination mailbox (a monitored security@ address, or your MSP's SOC).
- Configure user submission experiences: a pre-report confirmation prompt and a post-report thank-you message both measurably increase reporting.
- Review the Submissions page in Defender to see reports, analyst verdicts and the automatic disposition results.
When a report arrives, Defender can automatically pull the message from other mailboxes (ZAP) if the same campaign is confirmed malicious - which is exactly the outcome a forwarded "FYI" email can never produce. Third-party add-ins (PhishLabs, Cofense, KnowBe4 and others) do the same job with more customisation, but the built-in button is free and covers the core workflow.
Step 2: Google Workspace - the built-in Report phishing button
Gmail's Report phishing button ships enabled in the web interface and works in Gmail mobile apps: one click sends the message to Google and to your admin-configured postmark destination.
- In the Admin console, open Apps > Google Workspace > Gmail > Phishing and malware protection (and Spam settings in some layouts).
- Enable the settings for Email members to take action on suspicious emails / phishing report handling and configure where user reports are delivered.
- Route reports to a monitored address; Google's analysis action feeds its own filtering, and your team's review adds the human verdict.
Both platforms take under an hour to configure. If your mail runs through an MSP, this is a ten-minute request to put in writing this week.
Step 3: tell staff, then rehearse
A button nobody knows about is decoration. Three things install the habit:
- Announce it once, plainly: "If an email looks off, click Report Phishing. You will never be in trouble for reporting - including a false alarm, including a real click."
- Rehearse monthly. Every phishing simulation should be reported the same way as a real email - click rate and report rate both get measured, and anyone who clicks is auto-enrolled in a short lesson on the exact tactic that caught them.
- Close the loop. When someone reports a real email, tell the company what happened and thank the reporter by name. A report that vanishes into silence trains the organisation to stop reporting.
The cultural rules behind this - no blame, fast feedback, celebrated reporters - are covered in how to report a phishing email and how to report a suspicious email.
Step 4: measure it
Two numbers tell you whether the button is working:
- Report rate: the share of simulated and real suspicious emails reported. Under 10% means process or culture is broken; 20%+ within a few campaigns is healthy; monthly programmes reach 50%+ by month eight on Cyber Aware's benchmark.
- Time from arrival to report: the metric that decides whether the message gets pulled before the second person opens it.
Cyber Aware's human risk reporting tracks both per person per month and rolls them into one risk score, so the button's adoption is visible in the same report as training completion - and exportable for clients, insurers and auditors. If you are pairing the button with a full programme, Cyber Aware's security awareness training runs the monthly lesson-and-simulation cadence that feeds it, and the 2026 buyer's guide compares platforms on reporting automation.
FAQ
Should the button send to Microsoft/Google or to us? To both where the option exists. Provider analysis improves automatic filtering for everyone; your own mailbox is where the human verdict and the response happen.
What happens to a staff member who reports and later turns out to have clicked too? Nothing negative. The entire design depends on reporting being consequence-free; the click becomes a coaching data point, and the report is celebrated.
Can staff still forward suspicious emails to IT? Yes, as a fallback - the button is simply better, because it preserves headers and reaches the analysis pipeline directly.
Does the button work on mobile? Both Outlook and Gmail expose report actions in their mobile apps; coverage depends on client version, so verify on the devices your staff actually use.
One last thing
The report button is the only security control that gets more valuable the more people click it. Set it up this week, announce it with a no-blame promise, and rehearse it monthly - by month eight you should see more than half of every simulated phish reported, and the real ones caught by the same reflex.