Case Study

How an MSP Saved 50+ Hours Per Week with Phinbox IQ

Resonant Technology Partners was dealing with a flood of ~200 reported emails every week that technicians had to investigate. Their previous workflow required multiple manual steps for every reported message, consuming valuable technician time. After implementing Phinbox IQ, the MSP streamlined phishing analysis while drastically reducing investigation time from 20 minutes per email to 5 minutes or less.

Why Resonant Switched from KnowBe4 to Phin

“I would estimate we used to spend ~20 minutes per ticket. With Phinbox IQ, we spend 5 minutes or less." - Ethan Earl, Director of Automation

Although KnowBe4 allowed users to report suspicious emails, the workflow stopped there. Every reported message created a ticket, regardless of whether it was legitimate or simply a phishing simulation. Technicians still had to manually retrieve the email, analyze headers, determine whether it was malicious, and block senders across Microsoft 365.

Resonant wanted a platform that could automate much of that process while improving efficiency for both end users and technicians. Phin Security does just that!

Size

57 Clients

Active users

3,050+

Director of Automation

Ethan Earl

Partner Since

March 2026

Previous provider

KnowBe4

Challenges

Reported phishing simulations were generating support tickets.
Users received no immediate feedback after reporting suspicious emails.
Investigating a single reported email took roughly 20 minutes.
Technicians manually retrieved deleted emails and analyzed headers.
Blocking malicious senders required logging into each Microsoft 365 tenant individually.
Repeating the same remediation across multiple clients significantly increased technician workload.

Phin's Solution

"The user instantly gets feedback that they passed the test. A ticket isn't created on our side, which is great because we're not having to go and investigate those." - Ethan Earl, Resonant Technology Partner

Phinbox IQ eliminates unnecessary work before tickets even reach the help desk. When users report simulated phishing emails, they immediately receive confirmation that they successfully identified a simulation. No ticket is created, eliminating false-positive investigations.

For legitimate reported emails, Phinbox IQ automatically gathers email headers and uses AI to analyze whether the message is malicious. Instead of manually reviewing technical information, technicians receive an immediate assessment directly inside their PSA. (In this case, ConnectWise Manage.)

Previously, technicians repeated the same blocking process for every Microsoft 365 tenant. Now one action protects every client using the platform. If the email is malicious, technicians can block either the sender or the entire domain with a single click across all managed clients simultaneously.

When phishing emails are delivered from a common sender or domain in the future, the emails will have already been blocked before reaching additional customers, reducing both investigation time and ticket volume.

The result is a workflow that allows their technicians to focus on genuine security threats instead of repetitive administrative tasks.

Results

"Our previous workflow for blocking [an email] for all clients was 20 minutes per ticket multiplied by each client. But Phin has a single button to block it for all clients, which is incredibly useful." - Ethan Earl, Resonant Technology Partner

Resonant transitioned from a manual, repetitive workflow into an automated process that scales across their customer base. The team not only resolves individual tickets faster but also prevents future tickets by blocking threats across every managed client.

5 min

Resonant dropped investigation time per email from 20 minutes to 5. Since they receive ~200 emails per week, this has saved them 50+ hours per week.

1-click

Ticket volume is decreasing because fewer tickets are being created by phishing simulations and by domains that have already been blocked with one-click cross-tenant remediation.