Thirty-one staff report your own marketing newsletter as phishing - what verdict do you record?

## Three closures that are not the same thing The distinction the reported-message queue turns on is between three outcomes that a careless SOC records as one: - **False positive** - the thing you thought happened did not happen. The rule matched noise, or the reporter misread an ordinary internal mail with no suspicious properties at all. - **Benign true positive** - the thing really happened and was correctly identified, but it was authorised or harmless. Your own marketing campaign genuinely does look like phishing, and the reporters genuinely did spot it. Nobody was wrong. - **True positive** - malicious, and the case continues. Calling this morning's thirty-one reports false positives is the defect. It writes into your metrics that your reporters are unreliable, which is the argument someone will later use to retire the button, and it invites the wrong fix - suppress this sender - for a queue whose whole value is that humans look at things machines let through. ## Confirm from the trail, not from the claim Someone in marketing saying yes, that is our campaign, is a claim. The evidence is that the reported copies were sent by the infrastructure that vendor actually uses for your tenant, that the campaign identifier matches a send that was scheduled, and that the URLs in the reported copies resolve into that vendor's tracking domain rather than somewhere else. The reason to insist on this is specific rather than pedantic: the highest-value moment to imitate a company's newsletter is the morning that newsletter goes out, when every recipient is primed and the security team has an easy story ready that makes the report go away. A verdict of *this is us* that rests on a colleague's memory is the one an adversary is counting on. The same caution applies to the bulk close. Thirty-one reports that arrived in one morning are probably one campaign, but they are not necessarily one message: compare the sending infrastructure and the URL host across the set rather than the subject line, and confirm the count reconciles. The thirty-second report - a different message that happened to arrive in the same wave - is the one that gets closed with the crowd and found six weeks later. ## What the reporters get back The report button is a sensor made of people, and it is maintained by answering it. A reporter who hears nothing cannot distinguish *we looked, and it is our own campaign* from *nobody read it*, and the second interpretation is the one that stops them reporting. So each of the thirty-one gets a reply that names the campaign, confirms it is genuinely from the company, and says explicitly that reporting it was the right call. A templated reply is fine; silence is not. This is cheap - one case, one text, thirty-one sends - and it is the difference between a sensor that keeps working and one that quietly degrades in a way you cannot measure, because you never see the reports you did not get. ## The conversation with marketing The internal team is not an adversary and should not be handled like one, but they are the other chair in this case and they own the fix. Give them the diagnosis rather than a complaint: thirty-one colleagues judged this mail to be an attack, and here are the four properties that made them think so - a sending domain nobody recognises, a display name that does not match the address, every link rewritten through an unrelated tracking host, and an urgent deadline. Each has a cheap remedy: send from a subdomain of the corporate domain that staff have seen before, keep the display name and address consistent, and let the SOC know the send window in advance so the queue is not a surprise. The deeper point worth making once: a company that regularly sends its own staff mail that looks exactly like phishing is training them to click on mail that looks exactly like phishing. ## What not to do Do not allowlist the vendor's sending domain to stop future reports. Large marketing and bulk-sending platforms are shared infrastructure; other tenants on them are abused constantly, and an allowlist converts a future genuine phish delivered from that platform into one nobody can report or block. The affordable version is campaign-level dedup, a known-campaign auto-reply, and advance notice - reduce the cost of the reports, do not blind the sensor that produces them.