Someone close to the event may notice the first warning sign: an unusual message, an unexpected pop-up or a USB device left in the car park. Yet many people pass on what they have seen. KnowBe4 describes this as a behavioral obstacle rather than a technical failure.
Better software alone will not close that gap. When employees anticipate harsh questioning or personal punishment, they may conceal mistakes and leave responders without information that could have helped.
Silence begins with shame
People often hide a security mistake because admitting it feels like confessing. A user who followed a malicious link, connected a suspicious drive or handed over a password after a convincing phone call may fear judgment from colleagues or management.
That fear can delay the response until the situation has grown more serious. Early notice gives the security team more opportunity to assess what happened and decide what action is required.
KnowBe4 identifies three recurring barriers. The first is shame. The second is what it calls hero syndrome: technically capable employees may attempt to manage an incident privately instead of bringing in the security team. By the time they recognize the scale of the problem, the most favorable opportunity for a clean response may have passed.
The third barrier is diffusion of responsibility. When a questionable message reaches many inboxes, each recipient may assume another person has already raised it. Shared uncertainty can result in nobody reporting anything.
These patterns show why adding another detection tool does not necessarily improve the situation. The missing signal may be caused by the organization's culture, not its technology.
The reaction to a report shapes future behavior
Employees need an accessible way to raise concerns. More important is what happens after they use it. KnowBe4 says a reporter should receive thanks, with follow-up questions handled afterward. The inquiry should establish the sequence of events rather than determine who deserves blame.
False alarms require the same welcome. If a harmless email triggers embarrassment while a confirmed attack earns praise, employees quickly learn that they should remain quiet unless they can prove danger. Reporting only certain threats limits the organization's visibility.
Leaders also determine whether escalation feels normal. When senior colleagues openly raise problems and treat reports as useful contributions, that conduct encourages others to do the same. A written policy cannot create this example by itself; employees learn from what leaders visibly do.
This matters because tools and people see different parts of a potential incident. Monitoring can identify patterns, while an employee may recognize that a request is unusual because of the work it asks them to perform. A timely report can bring that context to the team before the activity develops.
Why it matters: the organization loses context when people stay quiet
Suspicious activity is often dismissed as an individual error rather than evidence. A strange email, a disruptive pop-up or an unknown drive may seem too small to justify involving the security team. That judgment can remove an important warning from the response process.
Social engineering makes this context especially valuable. A convincing message may pass automated checks while making an unusual demand of one person. When that employee feels able to speak up, the organization can examine the situation before the message progresses.
The response to uncertainty needs careful design. Excessive disruption for every questionable message may discourage people from bringing forward anything. Equally damaging is a culture that mocks harmless reports or treats those reports as personal failures. In both cases, employees may decide that silence carries fewer risks.
KnowBe4's position is not that employees should conduct their own investigations. People should raise unusual activity without attempting to resolve it themselves. They also should not connect a found drive or continue engaging with a questionable request. Once the concern reaches the designated team, that team can determine the appropriate response.
A reporting culture: what changes, and who benefits
| Organizational practice | Likely employee behavior | Organizational benefit |
|---|---|---|
| A report is treated as an admission of wrongdoing | Employees conceal mistakes or delay escalation | Responders receive less timely information |
| Reporting is presented as normal teamwork | Staff promptly flag unusual emails, pop-ups and devices | Suspicious activity reaches the response team sooner |
| Harmless reports receive appreciation | Employees remain willing to share uncertain concerns | The organization gains a more complete picture |
| Leaders visibly raise problems | Staff treat escalation as an expected part of work | Warning signs move through the organization more easily |
This change helps more than the security team. Employees receive a clear role: recognize something unusual and pass it on, rather than attempting a diagnosis. Leaders receive earlier insight into threats affecting colleagues, departments or business processes. The wider organization benefits when questionable activity is assessed before it causes greater disruption.
The route for raising concerns must reduce friction
A reporting channel should require less effort than falling for a deceptive message or attempting a private investigation. If staff must navigate a complicated process before they can alert anyone, hesitation becomes the system's natural outcome.
KnowBe4's 2026 Cybersecurity Awareness Month kit uses a secret agent theme. It includes character cards, tabletop exercises, training modules and a planner for organizing the campaign. Scout, the Week 4 character, represents the employee who sees something first.
That week's material concentrates on encouraging people to raise unusual activity and making escalation feel safe rather than damaging to their standing. The theme is useful only if colleagues act on Scout's warning. Leadership must listen, acknowledge the contribution and show that questions are intended to understand the event, not punish the person who raised it.
Once that behavior is established, existing technology can draw on better information. The organization does not need every employee to become an investigator. It needs people who feel comfortable saying, “This looks wrong,” and a response process that makes acting on that warning routine.
What to watch next
Watch the time between an employee's first observation and an alert reaching the security team. Also notice whether technically skilled employees are handling concerns alone, whether employees hesitate to mention harmless messages and how leaders respond when someone comes forward.
For organizations, the aim is to make raising a concern easier than concealing it. For employees, the boundary remains simple: recognize the unusual activity, avoid trying to resolve it and let the designated team determine the next step.
Key takeaways
- Make raising a concern easier than handling an incident privately.
- Thank employees for reports without treating false alarms as failures.
- Separate incident details from blame and investigate privately when needed.
- Use leadership behavior to establish that escalating concerns is normal.
Frequently asked questions
Why don't employees report suspicious security incidents?
KnowBe4 points to shame, fear of blame, hero syndrome and diffusion of responsibility. Employees may also assume someone else has already reported the issue.
Should employees investigate a suspicious email before reporting it?
No. KnowBe4 advises staff to raise unusual activity without attempting a fix. They should avoid using a found USB drive or continuing to engage with a suspicious message unless directed by the security team.
How should a company handle a false alarm?
It should acknowledge the report warmly. If every harmless email triggered blame or ridicule, employees would have a reason not to report a real threat later.
What makes an incident reporting process effective?
It needs to be easy to use and backed by a non-punitive response. Leadership should also report problems openly to show that escalation is expected behavior.