Module 5: E — Escalate
Most phishing training ends at "don't click." This module is what separates awareness from contribution. Your report becomes infrastructure — filter rules, blocklists, DMARC policy changes, domain takedowns. Five modules in, you've gathered the evidence. Now you send it.
What You’ll Learn
Module 5 is the E in TRACE — Escalate. The evidence is in your hands. This module turns that evidence into something that protects other people.
- Who to tell depending on the message type — there’s a decision tree for this, and most people have never seen it.
- How to write a report that actually helps — what a SOC needs in the first 30 seconds, and the template that gives it to them.
- What happens after you report — the lifecycle of a phishing report as it moves from your outbox into the industry’s shared defenses.
Why This Module Exists
Awareness training tells you to “report suspicious emails” and stops there. It doesn’t tell you where. It doesn’t tell you how. It doesn’t tell you why it matters. As a result, most reports never get sent — and the ones that do are often too thin to be actionable. This module closes that gap. By the end of it, you’ll know exactly where a report goes, exactly what it should contain, and exactly what your contribution sets in motion.