Adaptive Security

## How does Phish Triage work after an employee reports an email?

When an employee clicks the Phish Alert Button to report a suspicious email, that message is immediately sent to Adaptive's Phish Triage system for analysis. The AI engine examines the email's content, sender, and other indicators and then assigns it a confidence score for maliciousness. If the score is high (meaning it's clearly a phishing attack or harmful spam), Phish Triage will automatically resolve the case – this typically involves deleting the email from all user inboxes, or moving it to quarantine, within seconds across the organization. If the email is deemed clean (just a false alarm), it might simply be noted and no action taken. Importantly, only the emails that the AI cannot confidently classify (the low-confidence, ambiguous cases) are escalated to security administrators for manual review. In those cases, an analyst can look at the email details provided by Triage (and any AI insights) and then decide on remediation. This workflow means that the vast majority of phishing reports are handled automatically and instantly, while admins only see the few corner cases that need human judgment.