Providing the report button

Reporting is the action that helps in an emergency. Without a button in the mailbox it remains an instruction on the intranet.

What the button does

From an exercise message, the report closes the loop: it counts as the correct action in the results, and the reporting person receives a confirmation.

From a real message, the report goes to your organisation's security officer. What is transmitted is the message identifier, not the attachment: nobody passes on suspicious files this way.

Whether the identifier arrives with or without angle brackets makes no difference. Both spellings are normalised to the same form before matching.

Two separate extensions

There is a separate add-in for Outlook and a separate add-on for Thunderbird. Both are deliberately kept apart from the suite's other extensions: touching a manifest in productive use has caused an outage before.

Deployment

Distribution runs centrally through your organisation's admin center. An individually installed add-in behaves differently and is forgotten at the next device change.

After assignment it takes a few hours, depending on the environment, until the button is visible to everyone.

Common questions

Is the message deleted? No. The report neither moves nor deletes anything.

Does the person see whether it was an exercise? Yes. A reported exercise message is confirmed as such, and that is the intended learning moment.