You did the right thing and deployed a Phish Alert Button, and now the help desk drowns in reported emails. ThreeShield fixes both ends: Lavawall® answers most reports for the user so they never become a ticket, and our CISSP/CISA analysts manually review and resolve the ones your users ask us to check — for a predictable flat rate, not by the ticket.
Teaching people to report suspicious email is the right move. The catch is what lands next: techs triaging hundreds of reported messages a month, most of them harmless, a few genuinely dangerous, and no fast way to tell which is which. Phishing simulations make it worse, because every simulated test a user dutifully reports becomes another ticket. ThreeShield takes that whole workflow off your plate.
| Step | What happens | Result |
|---|---|---|
| 1. Lavawall® answers the user | The moment someone reports a message, Lavawall gives an instant, plain-language verdict — safe, suspicious, or malicious — and recognizes simulated tests so they never become tickets. | Roughly 93% of reports are resolved for the user without a ticket. |
| 2. ThreeShield reviews the rest | Our CISSP/CISA analysts manually review the reports users ask us to check and the genuinely suspicious mail Lavawall escalates, confirm the verdict, and close the loop. | Your techs stop triaging phishing entirely. |
See exactly how the volume drops on Lavawall's phishing-overload page.
You pay a set fee, not by the ticket, so a bad phishing week never turns into a surprise bill. We scope it to your user count and typical volume.
Reports users ask to have checked are reviewed by CISSP/CISA analysts who confirm the verdict and decide the disposition, then tell the user.
Works with the KnowBe4 Phish Alert Button and other reporters, or Lavawall's own. You do not have to rip anything out.
Lavawall recognizes phishing-simulation traffic and credits the user for reporting it, without ever creating a ticket.
Every check is recorded, so you can reward the users who watch for phishing and send coaching to the ones who need it.
The Lavawall® platform is hosted in Canada, with reported-message data kept against your own tenant.
Reported-phishing triage is a support cost you can turn into a managed service. Bring us in the way that fits.
| Model | How it works | Best when |
|---|---|---|
| White-label | We run the triage as your Tier 3, under your brand, across your client tenants from one multi-tenant console. | You want a new managed line and one less thing on your own desk. |
| Referral | You introduce a client drowning in reports; we deliver, and you earn a referral fee. | You would rather point the client to us than run it yourself. |
Either way, our rules of engagement are written down, and we never go around a partner to their client. Read more about how MSPs work with us on the MSP augmentation page.
Yes. You do not have to rip anything out. Keep your Phish Alert Button or switch to Lavawall's reporter, whichever you prefer. The point is what happens after a user clicks report: Lavawall gives the user an instant verdict so most messages never become a ticket, and ThreeShield handles the ones that still need a human.
You pay a predictable flat fee rather than by the ticket, so a bad phishing week does not turn into a surprise bill. We scope the rate to your user count and typical report volume, and it covers the manual review and resolution of the reports users ask us to check. For MSPs it is set per client so you can price and resell it cleanly.
Lavawall® answers the user at the moment they report a message: safe, suspicious, or malicious, in plain language, so roughly 93% of suspected phishes are resolved without a ticket ever being created. It also recognizes your phishing-simulation traffic and credits the user for reporting it instead of flooding the help desk. Only genuinely suspicious mail, already analyzed, is left for a person to decide on.
The reports that a user specifically asks to have a human check, and the genuinely suspicious mail Lavawall escalates. Our CISSP/CISA analysts confirm the verdict, follow the links and attachments where the automated analysis was not conclusive, decide the disposition, and close the loop with the user, so your own techs stop triaging phishing.
Yes. We run the triage as your Tier 3, under your brand, across your client tenants from one multi-tenant console, or you can refer a client to us and earn a referral fee. Our rules of engagement are public, and we never go around a partner to their client.
No, it strengthens it. Because Lavawall® records every check even when no ticket is created, you can see who is genuinely watching for phishing and reward it, and the engagement data feeds back into training so coaching goes to the people who need it.
In Canada. The Lavawall® platform is hosted in Canada, and reported-message data is kept against your own tenant rather than comingled with anyone else's, which matters for Canadian organizations with data-residency obligations.
Tell us your user count and how many reports you field, and we will quote a flat rate to reduce the flood with Lavawall® and review the rest — direct, or white-label as your Tier 3.
Get a Flat-Rate QuoteFlat rate · Works with your button · White-label for MSPs