Blog

Product Update:

Atlas User Reported Phishing Is Now Live

Justin Bailey

May 6, 2026

3 MINS READ

Atlas now triages every user-reported phishing email with AI — automatically. From the moment an employee clicks Report Phish to a structured verdict and recommended response action, the entire workflow is automated, auditable, and tenant-wide.

What’s New

User Reported Phishing is a new Atlas capability that replaces manual phishing triage with an end-to-end AI-powered pipeline. Employees report suspicious emails the same way they always have — Atlas handles everything downstream.

  • AI-Powered Investigation: Every reported email gets the same structured analysis in seconds — sender, headers, URLs, attachments, authentication checks, and social-engineering pattern matching.
  • Attack & Benign Verdicts: Atlas classifies each report with a confidence score and matched indicators, so your team only reviews what actually needs attention.
  • Response Orchestration: Define per-action policies — delete across the tenant, block the sender, notify the reporter — as automatic, approval-required, or hybrid by confidence level.
  • Phishing Dashboard: Real-time visibility into attack vs. benign findings, top reporters, top malicious senders, and investigation trends across your environment.
  • Two Setup Paths: Connect via a shared phishing mailbox (scoped by Exchange policy) or Microsoft Defender for Office — zero-config for MDO customers. Proofpoint, KnowBe4, and Mimecast integrations coming next.
  • Minimum Permissions by Design: Atlas reads only phishing submissions — never employee inboxes.


It’s a fully managed phishing triage capability built directly into the Atlas Platform — designed to give security and IT teams their time back while improving consistency and coverage.

Why It Matters 

Phishing triage is one of the most time-consuming, repetitive tasks in security operations. Better employee training drives more reports. AI-generated phishing drives more attacks. And the process of investigating each report — headers, URLs, attachments, authentication — stays manual.

25–30 min
Per Manual Triage
~90%
Of Reports Are Benign
~$12
Cost Per Investigation

Atlas User Reported Phishing eliminates this workload. AI investigates 100% of reported emails. Analysts focus on findings that matter. Response actions execute based on policies you define — not manual effort.

Attack Types Atlas Detects:

Business Email Compromise

Executive impersonation, wire-fraud and invoice-redirect attempts.

Credential Phishing

Login-page lookalikes with authentication spoofing (SPF / DKIM / DMARC).

Spearphishing

Targeted messages with weaponized attachments and tailored lures.

Account-Suspension Lures

"Your account will be suspended" panic lures that route to credential capture.

Redirect-Chain Links

Multi-hop URLs that evade static link inspection at delivery.

Compromised-Sender Threats

Malicious messages from trusted internal or vendor senders.

How It Works

1
Report
Employee clicks Report Phish in Outlook or Microsoft 365.
2
Ingest
Atlas pulls from a shared phishing mailbox or via MDO — never employee inboxes.
3
Investigate
AI investigates headers, URLs, attachments, authentication, and social-engineering patterns to determine correlation against current threats.
4
Respond
Atlas produces a verdict and recommended actions. Response Orchestration decides what executes automatically.

The Atlas Reported Phishing Dashboard

View of the User Reported Phishing dashboard

To learn how your organization can build cyber resilience and prevent business disruption with eSentire’s Next Level MDR, connect with an eSentire Security Specialist now.

GET STARTED

ABOUT THE AUTHOR

Justin Bailey
Justin Bailey Senior Director, Product Marketing

Justin Bailey is Senior Director of Product Marketing at eSentire, where he leads go-to-market strategy for eSentire's portfolio spanning MDR, offensive security, and threat intelligence. With deep experience across multiple security disciplines, and intelligence-driven security programs, Justin specializes in translating complex security capabilities into impactful and easy to understand narratives. He works at the intersection of product, marketing, and sales to drive growth through go-to-market activities.

Back to blog

Take Your Cybersecurity Program to the Next Level with eSentire MDR.

BUILD A QUOTE

Read Similar Blogs

EXPLORE MORE BLOGS