IT and security / Free editable template

Phishing response playbook template

A phishing playbook turns a reported email into a quick, repeatable response. This example triages the message in a sandbox, purges it from every mailbox if it is malicious, blocks the sender and links, then checks whether anyone clicked or entered a password and resets their account if so, ending with a note to users and lessons learned.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the phishing response playbook

View full-size preview ↗
Phishing response playbook example showing triage, purge and block steps, branch for users who clicked or logged in, evidence to keep
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Make reporting easy

    Give staff a report button in their email client and reply to every report. Fast reports are what make the playbook work.

  2. Purge first, then investigate

    Remove the email from every mailbox as soon as it looks malicious, before more people open it.

  3. Check who interacted

    Use sign-in and proxy logs to find anyone who clicked or entered a password. Reset and revoke sessions for those accounts straight away.

Questions about this template

What does the clicked or logged-in branch cover?

It is the route for users who opened the link or entered details, adding account resets and checks before the case is closed.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More IT and security templates →