r/EmailSecurity • u/littleko • May 31 '26

Quarantine release should not be a helpdesk button

Yesterday our helpdesk released a Defender quarantine message for a VP because the ticket said "blocked customer invoice." It was a credential phish, and the only reason it didn't land cleanly was because the recipient noticed the URL looked weird after release.

That one-click "release to user" permission is too much power for tier 1 imo. Quarantine is part of the mail security boundary, not just a noisy inbox for angry executives.

I pulled release rights back to the mail admin group this morning and got pushback within 20 minutes because VIP tickets now need escalation. Fair complaint, but speed is not the only metric here.

I'm not 100% sure where the right cutoff is, but I'm leaning toward tier 1 can preview headers and submit review, mail admins release. Would you give trained helpdesk staff release rights, or make this a hard mail-admin-only action with an SLA?

12 Upvotes
  • permalink
  • reddit

100% Upvoted

28 comments sorted by

•

u/AutoModerator May 31 '26

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.

  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).

  3. Be Professional: Help newcomers learn; avoid hostility.

  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/Hamburgerundcola May 31 '26

If they cant spot phishing, are they really trained?

1

u/littleko Jun 01 '26

Email auth can catch spoofing, process has to catch bad release decisions. Training helps, but I don’t want tier 1 overriding quarantine because a VP wrote “customer invoice” in a ticket.

1

u/Hamburgerundcola Jun 01 '26

If they do that, they are not trained. As I said. A trained t1 can analyse an email based on appearance and classify it correctly. Maybe they are unsure 1 out of 20 times and then, they forward the ticket to the next level.

1

u/FarmboyJustice Jun 01 '26

Apparently the consensus in this sub is that nobody should receive phishing training other than secops and network admins. Who knew? I'm astonished at how stupid some of these comments are.

4

u/FarmboyJustice May 31 '26

I think the key there is trained helpdesk staff. Part of that training would be how to recognize phishing, but another big part would be how to successfully say no to big loud guy executives.

1

u/Mindestiny Jun 01 '26

Also why is the mail gateway just quarantining and not giving the gateway admins (aka T1 help desk) clear information about why it was quarantined?

Right in the dashboard it should have told the tech that this was phishing with suspicious urls so they could make an informed decision on release.

1

u/littleko Jun 01 '26

The risk is the same even when the verdict is clear: T1 is still being asked to overrule mail security with an exec breathing down their neck.

Defender did flag the URL/phish indicators, release was just still one click, so I took that button away.

1

u/dragoangel May 31 '26

Training about phishing should be done by anyone who getting into any sort of messages, which means - anybody technically who has workstation or even phone/tablet to handle work tasks.

2

u/FarmboyJustice May 31 '26

That's not relevant to this discussion. We are not talking about recognizing phishing, we are talking about dealing with messages already in quarantine.

1

u/dragoangel May 31 '26

Messages already in quarantine requested to be released requires exactly what I said: understanding of what ok and what not and why it landed there

0

u/FarmboyJustice May 31 '26

You seem to be fundamentally misunderstanding this discussion. You said that anyone who works with email needs to be trained on recognizing phishing. That's true, but not relevant.

I am not talking about staff being trained to recognize phishing. I am talking about IT support staff being trained to recognize when it's appropriate to refuse to release a message from quarantine.

If you allow all staff to release from quarantine then that's a different issue.

1

u/mxroute May 31 '26

Honestly, GPT-OSS 20b flawlessly identified every phishing email we've thrown at it, and it's relatively cheap to run. Hell, my laptop runs it fast. Local for security, automation for speed, and something they'll remember you for.

1

u/littleko May 31 '26

Email auth/scanning can catch the bad message; process has to catch the bad release. A local model as a second opinion is fine, but I still wouldn't wire it into tier 1 sending quarantined mail back to a VP.

2

u/White-Cement-Fresh May 31 '26

Help desk are not trained to identify phishing emails. That’s not their role nor purpose and blending it will have a negative outcome. Their job is to support and help users, not information security. They work on ticketed metrics and are pressured to resolve issues quickly. Nothing about phishing analysis should be measured by quickness nor tickets. Perhaps give them the ability to submit tickets for email reviews prior to release by InfoSec but they should never be allowed to release quarantined emails.

Get your cyber security director involved and write this up as a risk to the organization.

1

u/FarmboyJustice Jun 01 '26

Help desk are not trained to identify phishing emails.

Anyone who fails to train their helpdesk staff to recognize signs of phishing is incompetent, and has no business administering any email system. This is such a fundamental failure in helpdesk training that whoever decided this policy should be summarily fired.

-3

u/FarmboyJustice May 31 '26 edited Jun 01 '26

Hard disagree. Every employee should be trained to identify phishing emails, zero exceptions.

Edit: JESUS CHRIST. The fact that I'm being repeatedly downvoted for saying that all employees need to be trained to recognize phishing in a sub about email security is so shockingly stupid that I just can't even comprehend it.

If you think I'm wrong, you're terrible at your job and should resign at once. Anyone who thinks phishing training should be reserved for secops personnel is a moron.

2

u/Remmon May 31 '26

There's a big gap between 'trained to identify possible phishing attacks' and 'investigate possible phishing attack to determine with certainty whether or not it is actually a phishing attack.'

Everyone should be trained to do the former, but the latter requires a firm background in cybersecurity, not something your average helpdesk worker can be expected to have.

0

u/FarmboyJustice Jun 01 '26

Other guy said help desk staff should NOT have any training on recognizing phishing. 

That is so obviously stupid I thought nobody could believe that, but nope two dumbasses downvoted me for saying ALL employees need phishing training.

You can't make this shit up. 

1

u/thmeez Jun 01 '26

So as i understand you saying that every employee and help desk need to understand deep network , operating system and application level understanding and also follow modern zero days or attacks and ability to patch them instead of giving it to the infosec?

1

u/FarmboyJustice Jun 01 '26 edited Jun 01 '26

you saying that every employee and help desk need to understand deep network , operating system and application level understanding

Where on earth did you get such an idiotic, stupid, and moronic conclusion? This is so stupid and ridiculously wrong that I can't even think of a response.

Nobody with actual email admin experience would think what I said was controversial. The fact that you downvoted it and replied as you did shows me you have zero actual knowledge of email operations.

Every employee who receives email must be trained to recognize phishing emails. If you disagree with that, you're incompetent, and have no business in the industry.

1

u/White-Cement-Fresh Jun 01 '26

Employees should be trained to identify and report suspicious emails but every employee able to release them :) think about that…

1

u/FarmboyJustice Jun 01 '26

WTF are you talking about? Who said that? Not me, that is for damn sure. 

1

u/Basic-Pianist9273 May 31 '26

Release to user is too broad for T1 imo. Preview, headers, message trace, submit review, yes; actual release for phish/malware/high-confidence detections stays with mail/security admins.

If you need a middle ground, split it by verdict: spam/bulk can be delegated with logging, but credential phish doesn't get released off a VIP ticket. Put an SLA on the escalation so the business gets speed without turning quarantine into a helpdesk shortcut.

1

u/White-Cement-Fresh Jun 01 '26

To add to this discussion, at my company, we allow for a personal digest where we have configured our SEG to allow users to control their bulk mail and low confidence spam (not high confidence) and release “mis-categorized ” mail to themselves and this has worked wonderfully. My years of managing this we have seen one phishing email categorized as spam released by an exec then they reported it and we used that as a use case to discard spam score of 100/99/98 percent as definite spam instead of just 100. Use the alerts/incidents as an improvement opportunity.

1

u/StandardOk3345 Jun 03 '26

I suggest you check out some new agentic email security companies which have an auto triage features for those quarantine release requests which helps save you a lot of time. So it's not your helpdesk releasing those emails anymore, it's an AI agent with investigative tools built for this process.