IT and users should start collecting real and legitimate emails automatically, using "Right" email to filter our "Harmful" emails. Apart from content, email has many metadata and network trace information (usually ignored by users). Making good use of email metadata can increase phishing email detections.

Relying on IT officers or security managers is likely creating a bottleneck in the anti-phishing response. Tools should enable users to help each other via reporting and sharing phishing intelligence