A one-click "Report Phishing" button in Outlook that sends a suspicious email straight to Versus Security Operations — turning every employee into a sensor. No message bodies are stored, and reporting a phishing simulation is always the right answer.
The Report Phishing button puts your whole workforce on the detection team. When someone spots a suspicious email, one click in Outlook sends it to Versus Security Operations — where it becomes a user report and an email detection, groups into the sender's case, and lights the people domain of your risk score. It is the human half of email security: the native control (Microsoft Defender for Office 365 or Google) catches what it can automatically; the button captures what a person noticed that the filter missed.
It is a lightweight Office Add-in served straight from Versus, so the task pane and the reporting API share one origin — there is nothing to host and no CORS to configure.
That is the entire experience — no forwarding to a mailbox, no copy-pasting headers.
Each report posts to Versus and creates:
From there it follows the normal Aegis path: the case can escalate to the Desk, where AutoPilot investigates it, and the governed email responses (quarantine the message, block the sender) are available on the case.
Privacy by design. The add-in needs only read access to the open message, and Versus stores metadata only — subject, sender, URLs, the reporter, and the note. Message bodies are never sent to or stored by Versus. The add-in carries a per-tenant, low-privilege report token whose only permission is to post a report; it cannot read anything from Versus.
If you run phishing simulations, the Report Phishing button is how employees pass the test. A user who clicks a simulated lure and does not report it becomes a human-domain finding; a user who reports it — real or simulated — is the good outcome and is never penalised. The button and the simulation are two halves of the same awareness-training loop: measure who clicks, reward who reports.
The task pane and manifest are served from your Versus instance. First, grab the report token, then push the add-in to users.
In Versus go to Security Operations → Email → "Report Phishing button — setup". Copy the manifest URL and the report token shown there. The token is per-tenant; you can rotate it from the same panel at any time (users re-enter it on next use).
Choose one:
Tenant-wide (recommended) — Microsoft 365 admin center
https://<your-versus-host>/api/aegis/email/addin/manifest.xml).Per-user sideload (for a quick pilot)
In Outlook: Get Add-ins → My add-ins → Add a custom add-in → Add from URL, paste the manifest URL, and confirm.
The first time a user opens the task pane it asks for the report token (one-time, saved in Outlook's roaming settings so it follows them across devices). Send your users the token from step 1, or pre-seed it. After that, reporting is a single click.
| Piece | Endpoint (served by Versus) | Purpose |
|---|---|---|
| Manifest | /api/aegis/email/addin/manifest.xml | Sideload this in Outlook / the M365 admin center |
| Task pane | /api/aegis/email/addin/taskpane.html | Saves the token, shows the message, reports |
| Report | POST /api/aegis/email/addin/report | Creates the user report + email detection (metadata only) |
Because everything is served from Versus, there is no separate add-in infrastructure to run, and the button always points at your own tenant's Security Operations.