{"id":45235,"date":"2026-09-03T16:43:33","date_gmt":"2026-09-03T14:43:33","guid":{"rendered":"https:\/\/smartfense.com\/?p=45235"},"modified":"2026-09-03T16:44:39","modified_gmt":"2026-09-03T14:44:39","slug":"journey-of-a-reported-email","status":"publish","type":"post","link":"https:\/\/smartfense.com\/en\/blog\/journey-of-a-reported-email\/","title":{"rendered":"The journey of a reported email, from 11:23 to 11:27"},"content":{"rendered":"

Wednesday, 11:23. Luc\u00eda receives an email that looks like it comes from IT, asking her to renew her VPN credentials before noon. Something feels off. She presses the report button and goes back to what she was doing.<\/p>\n

That is all she does. The previous piece in this series<\/a> left open the point that the reporting habit only holds if reporting has a consequence the person can perceive, and that this consequence depends on how long a real email takes to get an answer. Automated phishing email triage is what compresses that wait, and here is its journey step by step, without jargon. The times and the numbers belong to one specific organization, the same one as the previous pieces, and are not industry averages.<\/p>\n

What is the first thing checked when a reported email comes in?<\/h2>\n

The first thing is whether your own program sent it. That is the only question the platform can answer without investigating anything, because it holds the record of every phishing simulation<\/a> it sent, which is why it goes first.<\/p>\n

When the answer is yes, the case closes on the spot. The platform credits the person for spotting it, adds it to their score, and there is nothing left to analyze. Luc\u00eda\u2019s email is not a simulation, so the journey continues.<\/p>\n

What does the analysis of a reported email check?<\/h2>\n

11:24. From here the email is analyzed automatically, with the same level of detail someone from the security team would apply, but without anyone having to open it.<\/p>\n

It checks whether the email really comes from where it claims to, or whether someone is impersonating a known company. It follows each link to its final destination, because a link can display one address and lead to another. It examines the attachments, including the classic one that pretends to be an invoice and is not.<\/p>\n

And it looks at the images in the message. That is where a good part of what email security cannot see is hiding today. A QR code takes the place of the link and a screenshot takes the place of the text, so an analysis that only reads the text walks straight past both cases.<\/p>\n

\n

An analysis that only reads the text of an email cannot see the attack that arrives inside an image.<\/p>\n<\/blockquote>\n

How to simulate that attack to train your people is already covered in the article on quishing<\/a> on this blog. Here the QR code arrives in an email somebody has already reported, and what has to be done with it is decide what it is.<\/p>\n

And when the technical evidence is not enough?<\/h2>\n

Some emails are not settled by the evidence. The sender is legitimate, the links are on no list, there are no attachments, but the message asks for something that does not fit, with an urgency that does not fit either. This is the grey area where the judgment of a person used to be required.<\/p>\n

For those cases there is an artificial intelligence agent that analyzes what the email says and how it says it, from the urgency and the pressure to the pretext it uses to justify the request. It does not replace the technical check. It steps in when that check falls short, which is exactly where the difficult reports used to pile up.<\/p>\n

In Luc\u00eda\u2019s email the evidence is more than enough. The sender\u2019s domain was registered 48 hours ago, the links point to a server in a country where the company does not operate, and sender authentication fails.<\/p>\n

Verdict: phishing. Risk score: 92 out of 100.<\/strong><\/p>\n

What does the security team receive when the analysis is done?<\/h2>\n

11:25. What reaches the security team is a result instead of an email to open. It is three things.<\/p>\n