The mechanism in Keepnet's own description is a sequencing problem. Email primes the target. An SMS follows, claiming urgency. Then the voice call closes [12]. Email is asynchronous, so the target can pause and check with a colleague. The SMS and the call are synchronous, and by the vendor's framing the target has seconds [12]. User reporting is an asynchronous control. It works best on the leg of the attack the attacker has already stopped depending on.
Check the arithmetic before anyone builds a budget case out of this release. Verizon's 40% is relative and comes from simulations: mobile median click rate against email median click rate [3]. The Microsoft 2025 Digital Defense Report figure quoted in the same announcement is absolute: 54% click-through for AI-automated phishing against 12% for standard attempts, which the release calls a 4.5x multiplier [7]. Different bases. Apply Verizon's 40% to Microsoft's 12% baseline and you get 16.8%, well short of 54% [13]. One number measures the channel, the other measures the automation, and a slide that adds them is wrong.
The receiving end is where the launch is thin. The app is free to anyone on the App Store, and Keepnet says organizations can roll it out across a workforce [1]. Routing reported events into an incident workflow exists only for Keepnet customers [2]. Android is described as next on the roadmap [1]. An organization with a mixed fleet can therefore instrument its iPhones and tell everyone else to keep screenshotting. The announcement also does not say how the app captures a suspicious message or call record on iOS [14], which is the detail that decides whether one-tap is literal or a copy-paste with better branding.
The number worth carrying into a budget conversation is the FBI's. IC3's 2025 report counted $798 million in smishing and vishing losses from government impersonation alone, and per the release this was the first time those losses were measured as their own category [11]. A category is how loss data turns into a line item. Mandiant's M-Trends 2026, also cited, puts voice phishing in more than 60% of phishing-related incident response engagements [9], which is consistent with what responders have handled since MGM Resorts in 2023 and through Scattered Spider's April 2025 intrusions at Marks & Spencer and Co-op, estimated in the release at £270m to £440m in combined damage [8].
ENISA's 2025 Threat Landscape, quoted in the same announcement, puts roughly 60% of initial access at phishing and more than 80% of observed social engineering as already AI-supported [6]. That is the supply-side reason help desk and finance queues are first-touch surfaces [10]: the caller sounds right, in the target's language, at volume, and the cost per attempt keeps falling.
The DBIR makes the coverage point itself, naming WhatsApp, social media and personal email as channels where most corporate security tooling provides none [5]. Vendors do sell mobile report buttons. The gap is that 80% of organizations have already seen mobile phishing attempts while the telemetry, the gateway and the queue remain email-shaped [4], which means the click rate an awareness program reports each quarter describes the channel that clicks less [3].
