1. A method, comprising: generating a simulated phishing message, the message comprising a predetermined identifier in the message or in metadata of the message; electronically storing the predetermined identifier in a computerized data store; receiving a notification triggered by a user action by an individual that a message delivered in an account associated with the individual has been identified by the individual as a possible phishing attack; determining whether the identified message is a known simulated phishing attack by comparing the predetermined identifier to an identifier from the message or to the metadata of the message; if the message is determined to be a known simulated phishing attack based on the comparison of the identifier, providing feedback to the individual confirming that the message was a simulated phishing attack; and if the message is determined not to be a known simulated phishing attack based on the comparison of the identifier, forwarding the message for threat analysis; wherein determining whether the message is a known simulated phishing attack comprises comparing a characteristic or identifier of the message with a characteristic or identifier of a transmitted simulated phishing attack.