Malte ZanderContents
Leadership needs four answers from brand protection: how big is the risk, is our approach working, what didn't work, and what do we need to decide? A good report answers them on one page, with a few metrics that measure the end of a case and two or three cases as examples. You can use the template in this article as is.
- The APWG counted around 3.8 million phishing attacks in 2025 (APWG).
- In a study of 286,237 phishing URLs, the median lifespan was 5.46 hours and the average 54 hours (Lee et al., WWW 2025).
- In the same study, Google Safe Browsing took 108.73 hours on average to detect a page (Lee et al., WWW 2025).
What does leadership want to know?
Not how many domains were scanned, but whether the brand is protected. Four questions sit behind every good report:
How big is the risk? How many fakes were there, how dangerous were they and whom did they hit?
Is our approach working? How many cases were removed, and how fast?
What didn't work? Where are cases stuck, and which providers aren't responding?
What do we need to decide? Budget, legal action, communication, priorities.
Which metrics belong in the report?
Seven metrics are enough, as long as they are calculated the same way every month:
| Metric | Definition | Why it matters |
|---|---|---|
| New cases by source | Cases from scans, the report widget and support in the period | Shows where fakes get noticed |
| Critical cases | Cases with data capture, payment requests or fake verification | Shows the real risk |
| Removal rate | Share of relevant cases that are offline | Shows whether the approach works |
| Time to removal | Median from finding to offline, in hours | Shows the speed |
| Long-open cases | Cases open for more than seven days | Shows where to escalate |
| Recurring cases | Copies that come back after removal | Shows organized actors |
| Affected customers | Reports and support requests about fakes | Shows the external impact |
Because many phishing pages live only for hours, measure times in hours, not days. Measuring takedown success shows exactly how to calculate each metric.
Which numbers should you leave out?
Numbers that look big but decide nothing:
Domains or variants scanned. They measure effort, not impact.
Alerts without assessment. Many alerts can just mean many false positives.
Vague totals such as "threats blocked" without a definition.
Estimated damage without a basis. If you cite damage, cite only documented damage.
Template: monthly brand protection report
Copy the template and replace the placeholders. One page is enough:
Subject: Brand protection, monthly report [month year]
1. The situation in one sentence: [Example: Three new phishing pages targeting our customer portal, all removed. One fake verification page is still online, escalation is underway.]
2. Metrics compared with last month: New cases [number] (last month [number]), of which scan [number], report widget [number], support [number]. Critical cases [number]. Removed [number] of [number] relevant cases ([percent]%). Median time to removal [hours] hours. Open longer than seven days [number]. Recurring [number]. Customer reports about fakes [number].
3. Key cases: [Case 1: domain, type of fake, status, impact]. [Case 2: domain, type of fake, status, impact].
4. What didn't work: [Example: host in [country] is not responding; escalation to the registrar and Google Safe Browsing has been made.]
5. Decisions we need: [Example: approval for a domain dispute against [domain] with our law firm, approval for a customer warning.]
6. Focus for next month: [Example: embed the report widget on the verification page, add new partners to the ignore list.]
What goes into the quarterly report?
The same structure, plus three things that only show over a longer period:
Trends: how the metrics developed over three months, with a short explanation.
Patterns: recurring actors, templates, hosts or domain endings. See Linking cases.
Measures and their effect, such as whether a new reporting route brought in more tips.
How do you prepare the report?
With fixed sources and fixed definitions:
Export the case list or read it from your tool: new, open and removed cases.
Check the status per channel to spot long-open cases and missing responses.
Review support and widget reports to show the external impact.
Pick two or three cases that explain the situation well, one success and one open case.
Phrase the decisions as concrete questions with a recommendation.
Stick to the definitions, even when a different number would look better for once. A report only becomes valuable through comparability.
Which mistakes make reports worthless?
Too many numbers. Whoever shows twenty metrics doesn't say which one matters.
No comparison. A number without last month or a target can't be judged.
Only successes. Open cases and problems belong in the report, or the decisions are missing.
No request for a decision. A report that asks for nothing gets skimmed.
How does AI Fraud Protect help?
The AI Fraud Protect dashboard shows open critical threats, active cases, open takedowns and reports from the community. The live status shows per channel what has been sent, acknowledged or is still open, and every provider reply lands in the takedown inbox. The activity history records who initiated a takedown, changed a status or sent a report and when, and each case's evidence package can be downloaded as a ZIP. If you run several brands, each gets its own organization, so you can report per brand and for the group.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the dashboard and live status in the app.
FAQ
How often should we report?
Monthly on one page, quarterly with trends and patterns. Report critical incidents, such as a phishing wave against your customer portal, immediately rather than waiting for the next report.
Who should receive the report?
Leadership, plus legal, IT security, communications and customer service. Each of them makes decisions that depend on the report.
Which metric matters most?
The combination of removal rate and time to removal. It shows whether cases really end and how long customers are exposed to the fake.
How do we show value without estimating damage?
With measurable figures: cases removed, shorter times to removal, fewer long-open cases and concrete examples. Estimated "prevented damage" without a basis tends to weaken a report.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
Lee et al.: study on the lifespan of phishing pages, The Web Conference 2025