Security 2024

Getting your team to report security issues quickly matters more than most business owners realise. It is easy to assume that with the right security tools in place, the problem is handled. In practice, your people are the ones who see the suspicious email first, and how quickly they speak up often decides whether an incident stays small or turns into a breach.

Picture a common scenario. Someone on your team receives an email that looks like it is from a trusted supplier, asking them to update payment details. It is a phishing attempt, where an attacker poses as someone familiar to trick the reader into handing over information or money. If that email is ignored, or the person assumes someone else will deal with it, a single click can lead to a serious data breach and a real financial cost.

Industry research repeatedly finds that fewer than one in ten employees report phishing emails to their IT or security team. That is a low number, and the reasons behind it are usually straightforward:

  • They are not sure the email is actually a threat.
  • They worry about getting into trouble if they are wrong.
  • They assume it is someone else's responsibility.

If people have been made to feel foolish about a security mistake in the past, they are even less likely to raise the next one. Fixing that is less about technology and more about how your business treats reporting.

Start with understanding, not jargon

The most common reason people do not report an issue is that they are not confident about what a threat looks like. Training helps here, as long as it is practical rather than a slide deck full of jargon.

Use real examples your team will recognise, and show how a small issue can grow into a serious one when it goes unreported. Run the occasional simulated phishing email so people can practise spotting the signs in a safe setting. The goal is simple: everyone understands they have a genuine part to play in keeping the business secure, and that reporting something early is always the right call.

Make reporting simple

Even when people want to report something, a clunky process will stop them. Keep it as easy as possible, ideally a single button in Outlook or a clear point of contact everyone knows.

Make sure the whole team knows how to report an issue, and remind them from time to time. When someone does report something, acknowledge it quickly. A short thank you tells them they did the right thing and makes it more likely they will do it again.

Build a culture where speaking up is safe

Fast reporting depends on people feeling safe to speak up. If they expect to be judged or blamed, they will stay quiet. Leaders set the tone here. When a manager is open about their own near misses, it gives everyone else permission to do the same.

It can help to have a go-to person in each team who others can check with, which takes the pressure off reporting directly to IT. Keep security a normal part of conversation rather than a once-a-year event, and share the times when someone reporting early stopped a problem in its tracks.

When reporting is easy and welcomed, you are not only protecting the business, you are building a team that pays attention and acts. Encourage open communication, treat mistakes as a chance to learn, and remember the basic rule: the faster an issue is reported, the easier and cheaper it is to fix.