The average security analyst spends close to 30 minutes triaging a single reported phishing email — checking headers, tracing sender reputation, deciding whether to purge it from every inbox. Multiply that by the 40-plus reports a 200-person company gets in a normal week, and phishing triage alone eats 18-20 hours of SOC time before anyone touches a real incident.
Attackers no longer have that problem. As of early 2026, more than half of the spam and malicious email circulating the internet was AI-generated, and a targeted campaign now costs attackers over 95% less to produce than it did two years ago. Analysts are still working email-by-email while attackers scale with software. There's a better way: let an AI agent do the forensic first pass, and let the human make the one-click call.
IRONSCALES customer CloudTech24 cut phishing remediation time by more than 60% after deploying the platform's AI agents, recovering over 64 hours of analyst time a month without adding headcount. Another customer, LeafTech, reports resolving unclassified incidents 4x faster — freeing roughly two full-time analyst equivalents to work on higher-value security tasks. Here's how a lean security team can build the same workflow with three tools that already talk to each other.
What This Automation Actually Does — Turning Every Reported Email Into a Scored, Explained Incident
IRONSCALES launched its Phishing SOC Agent in 2026 specifically to close this gap: instead of a human opening a ticket and manually reconstructing what happened, the agent performs an L2-level forensic investigation automatically — sender authentication checks, look-alike domain detection, attachment and link analysis — and returns a structured verdict in minutes instead of hours. Claude API sits downstream of that verdict, translating the technical findings into a plain-English severity classification and a recommended action, which n8n then pushes into a Slack approval card. The analyst reads one message and clicks Approve, Escalate, or Dismiss.
This setup fits security teams of one to five analysts at companies with 100-2,000 employees, MSPs juggling multiple client tenants, and IT managers who inherited "security" as a part-time responsibility on top of their real job. If your team is already drowning in reported-email tickets and doesn't have a dedicated SOC, this is built for you.
How It Works in Practice — The Core Logic Behind Minutes, Not Days
The full guide (available below) covers all 12 steps in detail, including the exact n8n node configuration and the Claude API prompt template. Here's the core logic:
- Employee reports a suspicious email — IRONSCALES' Phishing SOC Agent automatically opens an investigation and generates a forensic verdict.
- n8n receives the incident via webhook — Claude API classifies severity and attack type, and drafts a plain-English summary for the analyst.
- Slack posts an interactive approval card — the analyst approves mailbox-wide remediation, escalates to the on-call lead, or dismisses false positives, all in one click.
Steps 4 through 12 — including the auto-close logic for high-confidence benign reports, the escalation branch for critical incidents, and the audit-log configuration most guides skip — are in the complete guide below.
The Results — Why Security Teams Are Already Automating This
According to IBM's Cost of a Data Breach research (cited via Deepstrike's 2026 analysis), organizations with extensive AI and automation in their security operations pay an average of $3.62 million per breach versus $5.52 million without it — a 34% reduction — and cut detection time from an industry average of 181 days down to 51 days.
IRONSCALES' own customer data reinforces the pattern at smaller scale: CyberScope, another named deployment, reports containing real phishing incidents within minutes of a user report, with manual classification workload reduced to almost zero.
Companies that automated phishing triage in 2025 are now running lean two-person security functions that used to require four. The gap is widening: every month without automation is another month of analyst hours spent on email forensics instead of the incidents that actually matter.
Tools You'll Need — Start for Under €40/Month
You can run this entire workflow for the cost of an IRONSCALES Protect license, an n8n Cloud starter plan, and pay-as-you-go Claude API usage.
| Tool | Role in This Workflow | Free Tier? | Paid From |
|---|---|---|---|
| IRONSCALES | AI-driven phishing detection, forensic investigation, and remediation | Yes (Starter) | $3.89/user/mo |
| n8n | Webhook orchestration, Slack routing, audit logging | Yes (self-hosted) | ~$20/mo (Cloud) |
| Claude API | Severity classification, attack-type reasoning, plain-English summaries | No | Pay-as-you-go |
| Slack | Interactive approval cards, analyst and escalation notifications | Yes | $7.25/user/mo |
[REQUIERE VERIFICACIÓN] IRONSCALES does not publish a native n8n connector — this workflow uses the HTTP Request node against IRONSCALES' documented webhooks API, the same pattern used for several other vendor integrations without a dedicated n8n app.
Who Should Use This — And Who Shouldn't
This is built for lean IT and security teams that already get more reported-email tickets than they can triage by hand, and for MSPs standardizing incident response across clients. It assumes you already have (or are willing to deploy) IRONSCALES as your email security layer — this isn't a from-scratch phishing detector, it's an orchestration layer on top of one. If you run a large, mature SOC with dedicated SOAR tooling already handling this, you may only need the Claude API summarization piece, not the full stack.
What's Inside the Free Guide
We've documented the complete implementation in a step-by-step guide. Here's exactly what's inside:
- Steps 1-12: the full webhook-to-remediation pipeline, including auto-close and escalation branches
- Page 6: the exact Claude API prompt template used for severity and attack-type classification
- Page 9: the Slack Block Kit JSON for the interactive approval card — copy-paste ready
- Real-world use cases: MSP multi-tenant deployment, single-analyst SMB team, and a hybrid on-prem/cloud mailbox setup
- Common mistakes: why skipping the escalation timeout causes incidents to go stale, and how to avoid it
Download the Free Implementation Guide — Save Up to 60% of Your Phishing Triage Time
Published this month, updated for IRONSCALES' 2026 AI Agents release. No signup required.
Frequently Asked Questions
Do I need to know how to code to set this up?
Basic n8n workflow-building helps, but there's no traditional coding involved — you're configuring nodes and pasting a prompt template, not writing software. Most IT-literate analysts get comfortable within a single afternoon.
Is IRONSCALES really free for small teams?
IRONSCALES Starter is free and includes phishing simulation and a threat dashboard, but the AI Agents (Phishing SOC Agent) used in this workflow require a paid tier starting at $3.89/user/month.
How long does initial setup take?
Most teams get the core webhook-to-Slack pipeline running in a single afternoon. Fine-tuning the Claude classification prompt and adding the escalation branch typically takes another 2-3 hours spread across the first week.
Phishing volume isn't slowing down, and neither is the AI generating it. The tools to fight back with the same leverage are already available — the only variable left is when your team starts using them.