Skip to main content

Integration Between BullPhish ID and INKY User Phishing Reports

Email SecurityIntegrationsReporting

We are requesting improved integration between BullPhish ID (phishing simulations) and INKY (email security) to better handle user-reported simulated phishing emails.

Current Issue:
When a user correctly identifies and reports a BullPhish simulation using the “Report Phish” button, the message is treated as a real phishing incident by INKY. This results in:

  • Unnecessary ticket creation (Autotask PSA)

  • SOC/technician time spent reviewing false incidents

  • User confusion due to lack of feedback

  • Increased noise in phishing reporting workflows

Requested Behavior:
When a user reports a BullPhish simulation:

  1. The system should automatically recognize the message as a simulation (via headers, tagging, or integration).

  2. The user should receive immediate feedback such as:

    • “Good catch — this was a simulated phishing test.”

  3. The event should be logged in BullPhish as a successful user action.

  4. The report should NOT:

    • Generate a phishing incident in INKY

    • Trigger SOC workflows or alerts

    • Create tickets in Autotask

Additional Suggestions:

  • Introduce a header/tag (e.g., X-Phish-Simulation: BullPhish) for easy identification

  • Allow MSPs to define handling rules for simulated phishing reports

  • Provide reporting on user detection success without impacting security incident metrics

Business Impact:

  • Reduces false positives and alert fatigue

  • Improves technician efficiency

  • Enhances user training experience with immediate reinforcement

  • Aligns phishing simulation outcomes with real-world SOC workflows

This integration would significantly improve operational efficiency and the overall effectiveness of the Kaseya security stack.

Posted by Geoff Levy ·
Status: In Progress3 comments

Log in to comment and vote

Comments3

  • Matt Sywulak

    Team•

    Oct 16

    Pinned

    Thanks for the detailed request. Here is where each part stands.

    Already in place

    • INKY recognizes BullPhish ID simulations and shows the user a congratulations message when they report one.

    In progress

    • A report of a simulation from a training platform your team has selected (BullPhish ID included) no longer opens a Threat Center case or sends webhooks. The report is still recorded, closed as a simulation.

    • No Autotask ticket is created for these reports unless the partner turns on "Also create tickets for reports of your recognized phishing simulations".

    • Report emails for simulation reports can be turned off. They stay on unless you change it.

    • AI Recommendations no longer suggest blocking simulation senders.

    Not being worked on at this point

    These are now tracked as their own posts so you can vote on them:

    We'll update this post when the in-progress part is released.

  • Kevin Sisson

    •

    Jul 27

    Any ETA when this might be corrected? Our techs can click the link in the Autotask ticket to see the INKY report that it is a bull phish message, but his is not efficient use of the tech’s time, leads to alert fatigue.

  • Jeremy Vance

    •

    Jun 9

    Broad platform support for tools like Inky is huge!