Skip to main content
Sanne van Opstal-Brakel
Employee
Sanne van Opstal-Brakel
Employee
October 6, 2026

Cybersecurity Awareness Month | Core 4 habit: scams are getting smarter, so reporting should get easier

This post is part of our Cybersecurity Awareness Month series, built around four core themes. Read the launch post here. First up: recognizing and reporting phishing.

Phishing is harder to spot, and AI is a big reason why: it writes convincing, personalized messages at scale. Verizon's 2026 DBIR links social engineering to 16% of breaches, and credential abuse shows up in 39% when you count every stage of an attack. You can't count on everyone to spot every scam. You can make sure that when someone does, reporting it takes seconds.
 

Make reporting easy, however it fits your setup

Here are a few options. Use one, or combine them.

  • Report straight from the email. Most suspicious messages are emails, so a "Report phishing" button in Outlook, or a dedicated mailbox to forward to, is the quickest route for your colleagues. IT gets the original message, with its links and details, and nobody has to attach a screenshot.
  • Report through TOPdesk. Add a subcategory under Incident Management, such as "Suspicious email / phishing", so it's easy to find in the Self-Service Portal. This also suits scams that don't arrive by email: the DBIR found that 41% of social engineering breaches involved other channels, like phone or social media.
  • Route it automatically. Set a default operator group on that subcategory (your security or IT team), so reports land with the right people without manual forwarding.
  • Give it its own short SLA. A phishing report then won't wait behind fifty "my mouse isn't working" tickets.
  • Add a notification (email or Teams) when a ticket lands there. Optional, but the right person knows straight away.
  • Link affected assets while handling the ticket. With asset management, the operator can see what else might be affected, and you keep an audit trail of what happened.

Whatever you choose, test it yourself first. Send a dummy report the way your colleagues would, and check where it ends up before you tell anyone it's live. Menu names can differ slightly between TOPdesk versions, so the Documentation Portal has the current steps.
 

When the next sixty seconds matter

For an account being taken over right now, or ransomware spreading, you can build your own panic button in TOPdesk. Our Security Officer and Data Protection Officer show you how in a 15-minute on-demand webinar.
 

What we do at TOPdesk

We take this seriously ourselves, too. Our IT team runs KnowBe4 to keep all TOPdeskers on their toes: regular, low-key phishing simulations and short awareness modules, not a yearly lecture nobody remembers by February. If you don't run something similar, this month is a good time to look into it.
 

A note on NIS2 and DORA

If NIS2 or DORA applies to your organization, TOPdesk can support the processes behind compliance, like incident handling and asset management. No tool makes you compliant on its own, and TOPdesk is no exception. Read more about it on this page (Dutch only). 
 

Your turn

How does reporting something suspicious work in your organization right now? One click, or a small adventure? Share it below.

Terms & ConditionsAccessibility statement