Keepnet, an Extended Human Risk Management (xHRM) and Secure Behavior Management platform, today launched the Keepnet SMS/Call Reporter. It is a free app that turns a suspicious SMS or phone call into a one-tap report. Anyone can download it for personal protection. Organizations can roll it out across their workforce. The app is available now on the Apple App Store, with Android release next on the roadmap. For Keepnet customers, reported events land in Keepnet Incident Responder. Security teams handle them in the same workflow as email phishing reports.
The launch arrives as 80% of organizations have experienced mobile phishing attempts (Verizon MSI 2025). Most of those incidents never reach security teams. The corporate report button, the secure gateway, and the incident pipeline still live entirely in the email layer.
The 2026 Verizon Data Breach Investigations Report tells the same story from the attacker side: mobile-based phishing simulations show “an increase of 40% in the median click rate” compared with email simulations (Verizon 2026 DBIR, p. 50). The DBIR team puts it directly on the same page: “Higher click rates make mobile devices the new favorite target. We’ve gotten better at spotting phishing emails, so attackers are moving to our pockets.”
The Keepnet SMS/Call Reporter closes that gap on the user side: a free app for reporting SMS and voice phishing attempts directly from the device. Reports flow into the same security team pipeline as email phishing for Keepnet customers.
Why mobile phishing outpaced reporting maturity
Attackers expanded beyond the inbox. SMS, voice, and email now arrive together in the same campaign, and email-only reporting workflows were not built for that. A few things shifted since 2022.
- Email reporting matured; mobile didn’t. The report button, secure email gateways, and security team enrichment workflows are mature at most organizations. SMS and voice have no equivalent. When an employee gets a fraudulent SMS impersonating IT support and asking for MFA verification, there is no corporate workflow to route it to. Security teams never see the attempt.
- Attackers moved into channels with no security team coverage. The DBIR 2026 records the move directly: “criminals are also using other messaging channels other than corporate email to reach employees, such as WhatsApp, social media, and personal email accounts. All platforms where most corporate cybersecurity solutions do not provide coverage” (Verizon 2026 DBIR, p. 50). ENISA’s 2025 Threat Landscape adds the European regulator view: roughly 60% of initial access begins with phishing, and more than 80% of observed social engineering activity is already AI-supported.
- AI cut the cost of voice impersonation. Real-time voice cloning runs in dozens of languages now. Microsoft’s 2025 Digital Defense Report tracked AI-automated phishing at a 54% click-through rate against 12% for standard attempts, a 4.5× multiplier. The pattern started with MGM Resorts in 2023 and continued with Scattered Spider’s April 2025 attacks on Marks & Spencer and Co-op, costing an estimated £270 to £440 million in combined damages. Voice phishing now accounts for over 60% of phishing-related incident response engagements (Mandiant M-Trends 2026). Voice phishing is a corporate problem now, not a personal one.
Attackers stopped running email-only campaigns. A multi-channel sequence is the new default. The email primes the target. An SMS arrives next claiming urgency. The voice call closes the deal. Email is asynchronous, so the target can pause, reread, ask a colleague. SMS and voice attacks are synchronous. The target has seconds.
What the research points to
- The phone is the corporate attack surface most awareness programs still measure the least
- Email-only reporting leaves SMS, voice, WhatsApp, and personal-email incidents off security team telemetry
- The question shifted from “did the employee click” to “how far did the conversation progress before verification happened”
- Help desks and finance teams are first-touch attack surfaces, following the Scattered Spider playbook
What this means for security teams
The FBI’s 2025 IC3 report counted $798 million in smishing and vishing losses from government impersonation alone, the first time these losses have been measured as their own category (source: FBI IC3 2025 Annual Report, p. 4). The gap between what’s measured and what’s being exploited is where the real money goes.
- Help desks are part of the attack surface, not adjacent to it
- Verification procedures matter more than awareness alone
- Reporting telemetry from the phone channel is the missing security team signal
- Email-only simulations leave the highest-engagement channels untested
Inside the Keepnet SMS/Call Reporter
Other mobile apps stop at consumer scam detection. Enterprise mobile defense stops at malware. The SMS/Call Reporter sits between: a one-tap button on the user’s phone that feeds the same security team pipeline as email phishing reports. Three design choices define it.
- User-initiated, privacy-first. The app receives only what the user explicitly reports. No SMS inbox monitoring, no call recording, no passive collection. The iOS sandbox enforces this and the application architecture reinforces it.
- One-tap report from the mobile device. A suspicious SMS or phone call goes to Keepnet in one tap. Multi-source threat intelligence and AI-driven analysis return a verdict in seconds: malicious, suspicious, spam, or no threat detected. No desktop, no ticket, no screenshot to forward. The friction that kills email reporting drops to zero on the channel that needed it most. Closing the visibility gap is not an awareness problem. It is three operational moves: more suspicious SMS and calls actually reported from the phone, faster analysis and triage before the incident escalates, and end-to-end visibility for security teams.
- Enterprise centralization through Keepnet Incident Responder. For Keepnet customers, reported SMS and voice events land in the same incident pipeline as email phishing reports, where the security team reviews, enriches, and escalates. Mobile reports become security team telemetry, not awareness data.
Voice and SMS phishing simulations have been purpose-built into Keepnet’s platform since 2022, with customers including SunExpress, Axa, Desjardins, Ryanair, Arriva, and Vodafone. Phone number coverage runs across the US, UK, EU, and parts of Asia. The company is ISO 27001 and SOC 2 Type 2 certified, and operates in line with ISO/IEC 42001:2023 and EU AI Act requirements. Keepnet also runs live voice-based social engineering assessments against help desks and high-risk employee groups.
What organizations gain
Deployed at workforce scale, the SMS/Call Reporter turns employees into sensors in places the existing control stack cannot reach. Security and risk leaders get:
- Visibility into SMS, voice, WhatsApp and personal-email phishing attempts that security teams previously did not receive
- One incident pipeline for email, SMS and voice phishing reports, with no separate workflow to build or maintain
- Faster time to security team awareness on the channel where engagement is highest (Verizon DBIR 2026)
- Stronger help-desk verification controls against vishing and executive impersonation
- A workforce-wide reporting reflex extended from email to mobile, measurable through simulation programs
“We spent a decade making the email report button second nature. The phone has none of that. Until employees have a one-tap way to report a suspicious call or text, security teams stay blind. That’s what the SMS/Call Reporter fixes,” said Ozan Ucar, Founder & CEO of Keepnet.
“Social engineering threats are rapidly expanding beyond traditional email into voice, SMS, collaboration platforms and AI-assisted communication channels. Organizations therefore need broader visibility, stronger reporting workflows and more resilient human risk strategies across the full communication landscape,” said Ayo Adebayo, Head of Information & Cyber Security, SunExpress Airlines.
How security teams can extend SMS/call reporting beyond email
The Keepnet SMS/Call Reporter is available free on the Apple App Store. Full product overview, enterprise deployment guidance, and a 90-second demo here. The app works alongside any security awareness or human risk management program, in-house or third-party. Organizations can extend reporting to SMS and voice without switching platforms. Keepnet invites CISOs, security and risk leaders, and security operations managers to:
- Give employees a way to report a suspicious SMS or call from their mobile in one tap
- Centralize mobile-channel reports in Keepnet Incident Responder alongside email workflows
- Track mobile reporting activity as security team telemetry, not as awareness data
- Close the visibility gap before the next SMS, voice, and email campaign lands
Attackers moved beyond the inbox. Enterprise visibility must move with them.
About Keepnet
Keepnet is an Extended Human Risk Management (xHRM) and Secure Behavior Management platform helping organizations reduce employee-driven cybersecurity risk through AI-powered phishing simulations, behavioral microlearning, security awareness training, and AI-driven phishing incident response. Keepnet contributes to industry research on voice and SMS phishing, including the 2026 Verizon Data Breach Investigations Report. The findings cited in this release draw on Keepnet research and tier-1 sources (Verizon DBIR 2026, Verizon MSI 2025, FBI IC3 2025, Microsoft Digital Defense Report 2025, Mandiant M-Trends 2026, ENISA Threat Landscape 2025). The full research paper “The Mobile Phishing Visibility Gap” is available here.
