Your people see the phish first. Make that count.
Filters stop most bad mail, but some always lands. When it does, the first line of defence is the person reading it. Phishing Incident Response gives that person a single button, and gives your security team everything that should happen next: the message analysed, its links and files checked, the sender's reputation looked up, and every other copy in the organisation found and removed.
It also shows you how alert your workforce really is. Who reports, how quickly, and how often they are right becomes a measurable number you can track month to month — and pair with Managed Phishing Simulation to train the people who don't report yet. XcellHost runs it on a leading platform*, connected to Microsoft 365 or Google Workspace, with optional 24×7 triage from our Mumbai SOC.
Three facts every security team already knows.
Some phishing always gets through
No filter catches everything. Newly registered domains, clean-looking links and plain-text requests slip past even well-tuned protection.
Email is still the favourite way in
Credential theft, invoice fraud and malware delivery usually start with a message. Close that door and many attacks never begin.
Everyone with a mailbox is a target
Finance, HR and front-desk staff receive the most convincing lures. Each one who reports instead of clicking buys the team time.
What changes on day one.
- Fewer email threats reach a clickSuspicious mail is checked and acted on while it is still unread in most inboxes.
- Reported mail leaves the inboxThe reported copy moves to junk or quarantine at once; confirmed phish is removed everywhere.
- Staff become part of the defenceOne obvious button, quick feedback and recognition make reporting a habit, not a chore.
- Security teams act on factsEach report arrives pre-analysed, clustered with look-alikes and ready for a decision.
Six checks on every report, and the tools to act on them.
Threat-intelligence lookup
Sender, domains, URLs and file hashes compared against known-bad feeds and previously seen campaigns.
Keyword & language traffic rules
Flag or hold mail by phrases, languages or patterns you choose — "urgent wire", "gift card", regional-language lures.
Header analysis
SPF, DKIM and DMARC results, reply-to mismatches, relay path and first-seen sender, shown in plain words.
Attachment & link checks
Files opened in a sandbox; links followed to the final page and judged for credential forms and lookalike brands.
Analyst full-message review
When automation is unsure, a person reads the whole message — on the Managed plan, an XcellHost SOC analyst.
Sender reputation report
History of the sender and domain across your organisation: first contact, volume, prior reports and verdicts.
From a click to a closed case — in five moves.
- 1 · ReportThe employee clicks Report Phish. The message moves out of their inbox and a copy goes to the queue.
- 2 · AnalyseHeaders, links, attachments and sender reputation checked; threat intel added; a risk score set.
- 3 · ClusterOther reports and unreported copies of the same campaign grouped into one case.
- 4 · RemoveEvery matching message quarantined across mailboxes; sender, URL and hashes blocked.
- 5 · CloseReporter thanked with the verdict; indicators sent to your SIEM; KPIs updated.
The reports that land on a Monday morning.
"Your mailbox is almost full"
Five people report it within ten minutes. One case, 240 copies removed, the fake login domain blocked.
A "new bank account" from a supplier
Accounts reports it before paying. Header and history checks show a lookalike domain; finance is alerted.
An HTML "voicemail" attachment
Sandboxed, found to open a login form, hash blocked and every copy pulled.
A real vendor newsletter
Marked safe in seconds, restored to the inbox, and the reporter still thanked for checking.
A Hindi "KYC update" SMS-style email
Keyword and language rules catch the pattern; future copies are held automatically.
Reporting your own training phish
Simulated emails are recognised, counted as a correct report, and never sent to the SOC queue.
Deployed, tuned and watched by one Mumbai team.
We check how reports are handled today and what your tenant already supports.
01Report add-in pushed centrally to Outlook (desktop, web, mobile) and Gmail.
02Who approves removal, who calls finance, what counts as a CERT-In incident.
03SOC analysts work the queue, remove mail and reply to reporters around the clock.
04Cases into Vortex SOC or Managed Sentinel; Security Operations takes it from there.
05One invoice for licence and service; pay by UPI, card or NetBanking.
06Six hours starts at notice.
A user report is often the moment you "notice" a phishing incident. Fast analysis tells you within minutes whether the six-hour clock applies.
XcellHost helps you meet these obligations; reporting and legal responsibility stay with your organisation. Confirm sector rules with your compliance team. Add the CERT-In incident reporting retainer below if you want XcellHost to prepare the report with you.
Per user, per year, billed annually.
Your Microsoft 365 or Google Workspace licences stay as they are. Minimum 50 users*.
The button, the automation and the console. Your IT team decides and acts.
- Report Phish button · Outlook & Gmail
- Header, URL & attachment analysis
- Threat-intel enrichment
- One-click removal across mailboxes
- Automatic reporter feedback
- Report-rate & MTTR dashboard
Everything in Essentials, with XcellHost's SOC working the queue 24×7.
- Everything in Essentials
- 24×7 SOC triage of every report
- Agreed playbooks, run by analysts
- Analyst full-message review
- CERT-In 6-hour assessment on each case
- Monthly report & quarterly review
Several tenants or brands, your own SOC, and automated hand-offs to SIEM and SOAR.
- Multi-tenant console
- SIEM / SOAR integration
- Custom playbooks & API
- Co-managed with your SOC
INR, excluding 18% GST. * Indicative — confirm with XcellHost: Essentials, Managed, the 50-user minimum, the SIEM/SOAR connector setup (₹29,999*) and the pilot are placeholders until confirmed on your quotation. Add-on prices without * are the same as on the linked pages.
Plan, users, add-ons. Annual total in rupees.
≈ ₹0 a month for the service · ₹0 per user a month
Excl. 18% GST until the total line. * Indicative — confirm with XcellHost.How many analyst hours do reports cost you today?
Move the sliders to match your month. The model is illustrative: it assumes automation cuts hands-on time per report to the minutes you set on the right, and removal across mailboxes to one action per campaign.
—
Price it for your users → Illustrative only. Hours by hand = reports × triage minutes + campaigns × purge minutes; automated = reports × confirm minutes + campaigns × removal minutes; value = hours saved × hourly cost × 12. Not a quote or a guarantee.Eight questions. How ready is your response?
Answer for your organisation as it is today. Your score and the next three things to fix appear as you go. Nothing is sent anywhere.
0 of 8 answered
- Answer a few questions first.
Forward-to-IT, built-in button, or full response.
Live in two weeks, measured from the first report.
Readiness review
How reports are handled now; what your tenant supports.
Connect & consent
Admin grants API access; reporting mailbox set up.
Button rollout
Add-in pushed to a pilot group, then everyone.
Playbooks live
Auto-removal rules and reporter messages switched on.
Report & tune
Report rate, accuracy and MTTR reviewed with you.