During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves.
However, many don’t report odd emails, strange pop-ups or the USB stick they found in the car park. This can be due to embarrassment, fear of getting into trouble or not wanting to be the one who cried wolf.
This is why incident reporting isn’t a technical challenge, it’s a behavioral one.
Scout, this year's Week 4 character, exists because someone always sees something first. The question is whether they tell anyone.
Why People Stay Quiet
Three reasons show up repeatedly when conducting an analysis of incidents when they occur.
Perhaps the biggest reason people don’t report issues is shame. Nobody wants to admit they clicked the link, plugged in the drive or gave someone their password over the phone because they sounded convincing. Reporting feels like confessing.
Second, hero syndrome. Some of your most technically capable people would rather quietly investigate and "handle it" than escalate. By the time they realize it's bigger than they thought, the window for a clean response has already closed.
Third, diffusion of responsibility. If an odd email lands in fifty inboxes, fifty people assume somebody else has already flagged it. Nobody does.
Having an easy reporting process certainly helps people, but what really helps is the underlying culture of what happens after someone reports an issue.
Building the Right Culture
The moment reporting an incident starts to feel like an interrogation, people stop doing it. Thank the person, ask questions later, and separate "what happened" from "whose fault is it." Additionally, the employee who reports a genuinely harmless email should get the same warm response as the one who catches a real attack.
A good way of encouraging this behavior is to model it from the top. If leadership never visibly reports anything, nobody below them will either. Culture flows downhill, not up.
Finally, the reporting mechanism needs to be quick and intuitive. If reporting a suspicious email takes longer than falling for it, you've built the wrong process.
Your Four-Week Plan
This year's Cybersecurity Awareness Month resource kit leans into the secret agent theme with four character cards, four tabletop exercises, training modules and a planner that makes running a month-long campaign less painful than it sounds.
Week 4's material is built specifically around this reporting problem: how to spot the moment worth flagging, and more importantly, how to make flagging it feel normal rather than career-limiting.
Every mission needs a Scout. The job only works if the rest of the team actually listens when Scout speaks up. Build that culture and the technology you already own suddenly works a lot harder for you.
Grab the full 2026 Cybersecurity Awareness Month kit and put Week 4 to work across your organization.
