How Stoïk Report works

Stoïk Report lets your employees flag suspicious emails in one click, directly from their Outlook or Gmail mailbox. Every report appears in Stoïk Protect, where you can triage it from a single page. This article explains how the feature works end-to-end, what you see in Stoïk Protect, and what changes when Stoïk Email Security is activated.

For deployment instructions and how to roll out the extension to your team, see Deploy and roll out Stoïk Report to your team.

Supported clients

Client	Support
Outlook on the web	Supported
New Outlook on Windows	Supported
Classic Outlook on Windows	Supported from version 2404 (Build 17530.15000)
Outlook LTSC Professional Plus 2024 (classic Outlook)	Supported (Mailbox 1.14)
Outlook on Mac	Supported from version 16.100 (Build 25072537)
Gmail (Chrome, Edge, Brave, or other Chromium browser, desktop only)	Supported
Outlook LTSC Professional Plus 2021 (classic Outlook)	Not supported (Mailbox 1.9 maximum)
Outlook on Android / iOS	Not supported
Gmail on Safari or Firefox	Not supported
Gmail on mobile	Not supported

The Report flow

From the moment an employee receives a suspicious email to the moment you triage it in Stoïk Protect, the flow looks like this:

1

An employee reports an email

The employee receives a suspicious email and clicks the Report Phishing button in their Outlook or Gmail mailbox.

2

Stoïk classifies the email

Stoïk immediately analyzes the email to determine whether it was part of a Stoïk phishing simulation sent by you, or a suspicious email from outside your organization.

3

The employee gets immediate feedback

A pop-in appears in their mailbox confirming the report:

• If the email was a Stoïk simulation, the employee sees a short message congratulating them and explaining the warning signs they spotted.

• Otherwise, the employee sees a confirmation that the report has been forwarded for review by the IT team.

4

The report appears in Stoïk Protect

The report is added to the Reported Threats table, accessible in Human Risk > Report > Results.

5

You triage the report

From the table, you can open the side panel to review the email's full context (sender, recipient, body, attachments, classification) and decide what action to take.

Reviewing reports in Stoïk Protect

All reports are centralized in Human Risk > Report > Results.

The Reported Threats table

The table shows every email reported across your team, with the following columns:

Column	What it shows
Reported at	When the employee reported the email.
Reporter	The employee who reported the email.
Sender	The original sender of the email.
Subject	The subject of the reported email.
Source	Whether the email is a Stoïk Simulation or a Suspicious email.
Validity	Whether the report is a True positive, a False positive, or Pending review.

You can filter the table by Status, Reporter, Source, or Validity, or use the search bar to find a specific email.

By default, the table is sorted by most recent report.

The side panel

Clicking a row opens a side panel with the full context of the report:

• The reporter (name, email, channel: Outlook or Gmail)

• The email itself (sender, recipients, subject, body preview, attachments)

• The analysis (source, validity, hints when available)

• Recommendations for what to do next, when the report needs your attention

Source: Stoïk Simulation vs Suspicious email

Each report is classified as one of two sources.

Stoïk Simulation

The email was part of a phishing simulation campaign you ran with Stoïk. The employee correctly spotted and reported a fake email designed to test their vigilance.

For these reports:

• The validity is automatically marked as True positive.

• No action is required from you. The report is counted in the campaign's stats and contributes to your team's overall awareness metrics.

• The side panel shows the simulation hints (for example, urgency wording, sender mismatch) so you can see what your employee spotted.

Suspicious email

The email is not part of any Stoïk simulation. It could be a real phishing attempt, a simulation from another vendor, or a legitimate email that simply looked suspicious to the reporter.

For these reports, the next step depends on whether Stoïk Email Security is active for your organization.

• Without Stoïk Email Security: we cannot determine the nature of the email automatically. The validity stays Pending. The side panel provides remediation steps to help you investigate (check the sender, check the links, confirm out-of-band).

• With Stoïk Email Security: the email is automatically re-analyzed by the Stoïk SOC. The validity is updated based on the SOC verdict and the appropriate action is taken. See the next section.

Email Security integration

When Stoïk Email Security is active for your organization, every reported Suspicious email is automatically re-analyzed by the Stoïk SOC. This means:

• You do not have to investigate the email yourself.

• The validity is updated with the SOC verdict: True positive if a real threat is confirmed, False positive otherwise.

• If a real threat is confirmed, the SOC takes action directly (quarantine across affected mailboxes, notification to your team).

Email Security also blocks the vast majority of real phishing attempts before they reach your team's inbox. The reports that still come through the Report button are the ones that slipped past the first line of defense, plus the legitimate emails employees just want to double-check.

If your organization does not have Stoïk Email Security yet, book a demo to learn more.

Frequently asked questions

What happens if an employee reports a legitimate email by mistake?

Nothing critical. The report appears in your Reported Threats table with Pending validity (or False positive if Email Security analyzes it and confirms it is safe). Encouraging employees to over-report is safer than encouraging them to under-report.

Can I see how many reports each employee has submitted?

Yes. You can filter the Reported Threats table by Reporter to see all reports from a specific employee.

Can I respond to the employee who reported the email?

Not directly from Stoïk Protect today. We recommend acknowledging valuable reports through your own internal channels (email, Slack) to reinforce the behavior. A short "thank you" message goes a long way for adoption.