How do you manage false phishing detections?

1 Check the sender and the context

Verifying the sender and context of an email is the first step to manage false phishing detections. These false positives can arise due to spoofed or similar-looking email addresses, domain names, or logos, as well as unusual or urgent requests, attachments, or links that trigger the security system. To check the sender and the context, you should look for any spelling or grammatical errors, mismatched names, or unfamiliar greetings or signatures. Additionally, hovering over the email address, domain name, logo, or link can reveal the actual destination or source. You can also compare the email with previous or expected communications from the same sender or organization. Finally, contacting the sender by phone or another channel is a great way to confirm the email's authenticity and purpose.

2 Report the false positive

The second step to manage false phishing detections is to report the false positive to your email security system or provider. This will help them improve their detection and prevention algorithms and reduce the chances of future false positives. You can use the built-in reporting feature if available, or forward the email to a designated email address or contact person. Additionally, you should follow the instructions or guidelines of your email security system or provider for reporting false positives, if given.

3 Adjust your settings and filters

The third step to manage false phishing detections is to adjust your settings and filters to optimize your email security system or provider. This will enable you to customize your level of protection and control over your emails. You can whitelist or blacklist certain email addresses, domain names, or keywords, change the sensitivity or threshold of your email security system or provider, and enable or disable certain features or functions, such as quarantine, notification, or deletion. Doing so will help you match your risk appetite and tolerance while providing you with a secure email system.

4 Educate yourself and others

The fourth step to manage false phishing detections is to educate yourself and others about phishing detection and prevention. This will help you build your security awareness and skills, as well as share best practices and lessons learned with your colleagues and contacts. To stay informed, you can take online courses, webinars, or workshops on phishing detection and prevention offered by Skillsoft. Additionally, you can read blogs, articles, or newsletters on the same topic published by Skillsoft. Moreover, participating in phishing simulations, tests, or exercises will help you practice your phishing detection and prevention skills and measure your performance.

5 Review and update your policies and procedures

The fifth step to manage false phishing detections is to review and update your policies and procedures related to email security and communication. This will help you set clear and consistent rules and expectations for yourself and others regarding email usage and etiquette. To make sure your policies are up-to-date, consult with your IT department, security team, or email security system or provider. Additionally, communicate with your managers, co-workers, clients, or partners to ensure that your policies are aligned. Lastly, document and disseminate your policies and procedures for email security and communication to guarantee everyone is aware of the rules.

6 Learn from your mistakes and successes

The sixth step to manage false phishing detections is to learn from your mistakes and successes. This will help you improve your phishing detection and prevention skills and strategies, as well as avoiding repeating the same errors or missing the same opportunities. To do this, you should analyze the causes and consequences of your false phishing detections, both positive and negative. Additionally, you should identify any gaps and strengths in your phishing detection and prevention skills and strategies. Furthermore, it is important to implement the feedback and recommendations from your email security system or provider, IT department, security team, or peers.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?