To get fast reports of security mistakes, treat honest errors as system problems and respond with help, not punishment. Say it in writing, act on it in the first real case, and reserve discipline for deliberate or repeated reckless behavior. Speed of reporting is worth more than the satisfaction of blame.
Why it matters
A click on a phishing link reported in five minutes is a small incident. The same click reported after two days may be a breach. CISA's guidance tells staff to change passwords immediately if they suspect phishing and then report it, which only works if they feel safe doing so.
The norm in three sentences
Write something like this in your policy: "We want to hear about mistakes quickly. Good faith reports will not lead to discipline. We will ask what in our systems made the mistake easy."
Make the first case count
The first time someone reports a mistake, thank them in public, if they agree. Keep their name out of any write up. Treat that moment as the proof of your policy. If the first reporter is punished, the program is over.
Separate three kinds of events
- Honest error: Clicked a convincing link; Help, learn, fix controls
- Process gap: Nobody told them the rule; Fix training and docs
- Reckless or deliberate: Disabled a control repeatedly after warnings; Normal HR process
Most events fall in the first two rows.
Run blameless reviews
After an incident, hold a short review:
- What happened, in time order?
- What made it easy to happen?
- What detected it, and how fast?
- What one change would reduce the chance or impact?
Publish a short summary without names. Track the actions to completion.
Remove the easy mistakes
If people keep pasting secrets into chat, add secret scanning. If they keep clicking, add phishing resistant sign in so a stolen password is not enough. Controls that tolerate error are better than lectures.
Watch your own behavior
Leaders set the tone. If a manager jokes about the person who got phished, reports drop. Coach managers to respond with thanks first.
Measure
Track time from event to report, number of self reports, and the share of incidents found by staff versus tools. Rising self reports are good news, not a sign of more risk.
The OWASP Security Culture project frames results as workplace conditions rather than personal traits, which is the same stance.
Quick check
Does blameless mean no accountability?
No. It means honest errors lead to learning, while deliberate or repeated reckless acts still go through normal processes.
How do we know it is working?
Reports arrive faster and more often, and people mention near misses without being asked.
Sources
Last reviewed: 19 October 2026.
