Report Phishing button for Outlook and Gmail

Last updated: 2 November 2026

Report Phishing is a free button for Microsoft Outlook and Gmail, made by Vaydel for companies that use Vaydel's security awareness training. It lets employees report a suspicious email in two clicks.

What it does

1. An employee opens an email that looks suspicious and chooses Report Phishing.
2. The button shows the email's subject and sender and asks them to confirm.
3. If the email was a phishing test from their company's Vaydel training, the employee is told straight away that they spotted it, and the report counts in their company's training results.
4. Any other email is sent to their company's security team to review.

Who can use it

The button is for employees of companies with a Vaydel account. Anyone can install it, but reports are only passed on for people listed as employees in a Vaydel account. For everyone else, the button asks them to tell their IT team about the email.

How to install it

• Gmail (Google Workspace): a Google Workspace admin installs Report Phishing from the Google Workspace Marketplace for the whole organization (Admin console → Apps → Google Workspace Marketplace apps).
• Outlook (Microsoft 365): a Microsoft 365 admin goes to the admin center → Settings → Integrated apps → Upload custom apps, chooses "Office Add-in", and provides this link: https://vaydel.com/outlook-addin/manifest.xml.

To have employees use only this button, a Microsoft 365 admin can hide Outlook's built-in Report button in the Microsoft Defender portal → Settings → Email & collaboration → User reported settings → "Use a non-Microsoft add-in button".

What data it uses

The button only works on the email the employee has open, and only when they use the button.

• To check whether the email is a Vaydel training email, it reads that email's headers and links, looking for Vaydel's training code. Only that code is sent to Vaydel.
• When the email isn't a training email, it sends Vaydel the reporter's email address and the email's subject, sender and the first part of its text, so Vaydel can pass it to the company's security mailbox. Vaydel keeps a record of who reported it and the subject; the email's text isn't stored.
• It never reads other emails, never changes or deletes emails, and never sends emails on the employee's behalf.

Google user data. Vaydel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Gmail is used only to provide the reporting feature described above. It isn't used for advertising, isn't sold, isn't used to train AI models, and isn't read by people except the reporting company's own security team, or when needed for security, legal compliance or with the user's permission.

More detail is in our Privacy Policy.

Help

Email clientsupport@vaydel.com. Company admins can also open a support ticket from their Vaydel dashboard.