Building a Security Reporting Culture: Why Punishing the Employee Who Clicked Backfires

When an employee who clicked a phishing link is punished, it is easy to predict what everyone else will do: they will click too, and tell no one. The breach will sit for days where nobody can see it. The foundation of security culture is that mistakes can be reported quickly and without fear. In this article we explain why a reporting culture is critical and how to build one.

Employee silence is a security risk

If mistakes are not shared, suspicious emails are not reported and doubts about policies are not voiced, security operations weaken fast. At that point the real weakness is human behaviour more than technology.

Every day an attacker spends inside an organisation unnoticed adds to the damage. Very often the first person to notice the attack is the employee who made the mistake. If they stay quiet, the organisation loses its earliest warning signal.

The "I would never fall for it" crowd is a bigger risk

Someone who says "I would never fall for a phishing email" fits exactly the profile an attacker looks for. A confident person checks emails less carefully, assumes they would notice and skips the second look.

One of the most striking examples is Troy Hunt, founder of Have I Been Pwned. Hunt, one of the best-known security experts in the world, fell for a phishing email in March 2025. He had just come back from a long flight and was tired. An email claiming to be from Mailchimp said his account had been restricted because of a spam complaint. Hunt clicked the link and entered his password and one-time code. When the page froze he realised what had happened, but the attack was automated and thousands of email addresses had been exported within seconds.

Hunt shared what happened openly. It is the best example of a reporting culture at the individual level: anyone can be tired, busy and distracted one day. What counts is what you do after the mistake.

The right answer: "Thanks, we're looking at it now"

The best response to an employee who says "I did something, could it be a problem?" is "Thanks, we're looking at it now." A security team that can say this gives the organisation its earliest warning system.

But the security team cannot create this culture alone. A culture that protects the person who reports needs leadership support. Someone hired for accounting or HR should not have to carry the organisation's security alone. Nor should the security team carry the burden of building this culture alone.

Do your employees know how to report? A 30-second test

Picture this: "Today's surprise: lunch coffee on us for the first 10 people. Scan the QR code now!" It arrives by email. Opening it, reading it and typing a username and password takes roughly 30 seconds.

Now, once it turns out to be a scam:

• Who will the employee report it to?
• How: by email, by phone, with a button?
• Is the process defined?
• How long does reporting take?
• Do all employees know the answers to these questions?

In a world where an attack takes 30 seconds, a reporting process that takes 30 minutes is a serious gap.

How to build a reporting culture

1. Set one easy channel. A "report suspicious" button in the email client is the most effective method.
2. Respond to every report. The person who reports should see that it made a difference.
3. Protect whoever admits a mistake. An employee who clicks and reports immediately is more valuable than one who did not click but stays silent.
4. Leaders set the example. Seeing managers report their own suspicious emails spreads the culture fastest.
5. Measure it. Reporting rate and time to report are the most concrete indicators of security culture.

Culture change is a long process, with no overnight transformation. Building trust and a structure where employees have a voice takes time and commitment. If the leadership team does not own the process, the transformation will not succeed.

Frequently asked questions

---
InfoLore designs security culture programmes built around reporting. Get in touch to review your organisation's reporting process together.