Can my agent spot phishing or social-engineering attempts?

It's designed to treat unknown and external contacts with suspicion. It will flag likely impersonation, for example a fake "journalist" account asking for a meeting.

It isn't perfect. If someone inside your company is persistent enough, it can sometimes be talked into things. Tell us about any interaction like that so we can harden it, and keep truly sensitive information out of its reach.