1. A method, comprising: receiving a notification that a message has been identified by one or more individuals as a possible phishing attack, the message having been received on a computing device of each of the one or more individuals; determining whether the message is a simulated phishing attack; if the message is determined to be a simulated phishing attack, recording in a database that each of the one or more individuals has correctly identified the message as a possible phishing attack; and if the message is determined not to be a simulated phishing attack, determining whether the message is likely a real phishing attack; if the message is determined to likely be a real phishing attack, determining a trustworthiness level for each of the one or more individuals; and processing the message based on the trustworthiness level of each of the one or more individuals; and if the message is determined to not likely be a real phishing attack, not performing further analysis on the message.