"An employee who does not report is not a risk but a symptom of a culture that punishes." Reporting may well be the most important behaviour in security. Yet employees often do not report. Not because they do not consider it important, but because the threshold is too high, or the fear too great.
The real problem: fear and thresholds
There are many reasons why people do not report. Fear of the consequences ("will I be punished?"), shame ("I should have known this"), uncertainty ("is this even an incident?"), or simply hassle ("how do I report this, and to whom?"). Each of these thresholds reduces the chance that someone passes on a suspicious message or a mistake.
And that is dangerous. Because every unreported click, every ignored suspicious message, is a missed chance to stop an attack early. The time between the first click and the report often determines how big the damage becomes. The longer that silence lasts, the more room the attacker gets.
Reporting must be easy and safe
If you want people to report, you must arrange two things: make it easy, and make it safe. Easy means: one clear button, one known address, one simple action. The fewer steps, the more reports. Safe means: no punishment, no shame, no consequences for those who report honestly.
The most powerful thing an organisation can do is reward reporting instead of punishing it. Thank people who report, even when it turns out to be a false alarm. Because a false alarm is infinitely better than a missed attack. Whoever reports does exactly what you want, even if it turns out to be nothing.
So celebrate the reporter, not the non-clicker. Make reporting a sign of professionalism, not of failure. "Good that you passed it on" should be the standard response, always.
From silence to a reporting culture
A reporting culture does not arise by itself. It is built, deliberately and consistently. It starts with psychological safety: the feeling that you can admit a mistake without being called to account. Without that safety people stay silent, and silence is the most dangerous thing there is.
When reporting becomes normal, the whole organisation changes. Suspicious messages are passed on quickly, attacks are stopped early, and employees feel part of the defence instead of the problem. The silence disappears, and with it disappears the attacker's biggest ally. Because an attacker counts on silence, and a reporting culture takes exactly that away.
Related articles
FAQ
Why do employees not report incidents?
Fear of punishment, shame, uncertainty or hassle. Every threshold lowers the chance of reporting. The solution: make reporting easy and safe.
How do you raise the report rate?
One clear button, no punishment, and reward every report, even a false alarm. Always thank the reporter. Easy plus safe equals more reports.
What do you do with a false alarm?
Thank the reporter sincerely. A false alarm is better than a missed attack. Punishing false alarms means the end of your reporting culture.
How do you build a reporting culture?
With psychological safety: admitting mistakes is allowed, without consequences. Celebrate the reporter, not the non-clicker. Consistently, over a long time.