- What it is
- How the employee reports
- Triage by the manager
- Confidentiality of the compliance channel
- Reward for reporting
- Related
What it is
Beyond simulation, the platform gives employees a channel to report real incidents: a suspicious email, an attempted scam, a conduct issue. This complements PhishER (which handles email forwarding) with a structured form for any kind of occurrence.
How the employee reports
In the portal, under Report (/c/reportar), a three-step wizard:
- Group: security, social engineering, compliance or other.
- Category — within the group (phishing, smishing, vishing, BEC, invoice fraud, compromised account, harassment, etc.).
- Details, where you give the title, description, severity, when and where it happened, and the option to report anonymously.
Employees track their occurrences in My reports (/c/meus-reportes), with status and the manager’s response.
Triage by the manager
In Reports (/reports), you work the queue:
- Filter by status and group, open the detail with the timeline.
- Classify: in triage → real threat, false positive or resolved, with notes and a resolution that goes back to the employee.
The cycle is: received → in triage → real threat | false positive | resolved.
flowchart LR
R[Received] --> T[In triage]
T --> A[Real threat]
T --> F[False positive]
T --> S[Resolved]
classDef good fill:#3ddc97,stroke:#3ddc97,color:#070a0e;
class A good
Confidentiality of the compliance channel
Compliance reports (code of conduct, harassment, discrimination, misuse of data) are handled separately:
Compliance reports are ALWAYS anonymous and go to the Ombudsman. Neither Administrator nor Manager can see them, which preserves the confidentiality of the whistleblowing channel.
In the other groups, the employee chooses whether to identify themselves; when anonymous, the reporter’s data is removed.
Reward for reporting
Reporting the right behavior is rewarded. An occurrence classified as a real threat grants XP to the employee, and a resolved one rewards too. A false positive carries no penalty. The goal is to encourage the habit of reporting.
Related
- PhishER — the channel dedicated to forwarded emails.
- Roles and permissions — the Ombudsman role.
