- › Reporting a suspicious email is a behavior, and behaviors that never produce a visible result fade, however well people were trained.
- › In many organizations reports land in a shared mailbox nobody owns, while simulated phishing reports get an instant congratulations, which teaches people that only the tests matter.
- › The cost of the silence is the one real attack that nobody mentions, because the person who saw it stopped reporting months ago.
- › Acknowledge every report, tell the person what it turned out to be, give the mailbox a named owner, and thank people for false alarms.
- › Measure how long it takes a reporter to hear back, alongside how many people report.
A scheduler at a medical practice gets an email that does not feel right. It says it is from the billing system, the logo is slightly off, and it wants her to confirm her login. She does exactly what the training told her to do and clicks the report button in her email client. The message disappears, and nothing else happens.
A few weeks later there is another one, and she reports that too. Nothing comes back. By the third month, when a colleague leans over and asks whether she bothers reporting the weird ones, she says she used to, but she does not think anybody reads them.
She is right. The reports go to a shared mailbox that was set up during an awareness campaign two years ago, and it now holds more than a thousand unread messages. Nobody in this story did anything wrong on purpose, and the organization has quietly trained one of its most attentive people to stop paying attention.
Reporting Is a Behavior, and Behaviors Need Feedback
I spend a lot of my time on why people do or do not keep doing the secure thing, and the answer is rarely about knowledge. The scheduler knew exactly what to do. What she lacked was any sign that doing it mattered.
People repeat actions that produce a visible result and quietly drop the ones that disappear into silence. That holds for exercise, for suggestion boxes, and for reporting suspicious email. A report button that never answers is asking someone to keep doing a small, slightly awkward task forever with no evidence that it helps anybody, and most people, reasonably, eventually stop.
The awareness training told her that she was the human firewall and that every report counts. The system around her told her, three times, that nobody was listening. When the message from training and the message from experience disagree, experience wins almost every time.
Where the Reports Actually Go
When I look at how organizations handle reported email, I usually find one of three arrangements. The reports land in a shared mailbox that belongs to a team that has since been reorganized. Or they become tickets in a general IT queue, sorted alongside password resets and printer problems, and closed in a batch at the end of the month. Or they go to a security tool that analyzes them automatically and never tells the person anything at all.
There is often a fourth detail that makes it worse. When an employee reports a simulated phishing email, the simulation platform immediately thanks them, sometimes with a cheerful message and a score. When they report a real one, they get silence. Nobody designed it that way on purpose, but the lesson people take from it is clear enough: reporting matters during the test, and not the rest of the time.
What the Silence Costs
The obvious cost is that people stop reporting, and the less obvious cost is what they do instead. Some forward the strange email to a coworker to ask whether it looks real, which spreads it further. Some delete it and move on, which leaves the next person in the building to face the same message alone. A few start to feel faintly foolish for ever having reported anything, which makes them less likely to raise their hand about other problems too.
The real cost arrives on the day an attack actually gets through. The email that leads to a stolen login or a changed bank detail almost always reaches several people, and somebody usually notices something off. In an organization where reporting has been allowed to fade, that person shrugs and closes the message, because experience has taught them that telling anyone changes nothing. We wrote about one version of that day in the email that changes the bank details, where the person who could have stopped the payment is often the person who felt something was wrong and said nothing.
Meanwhile, the reporting rate on the security dashboard drifts down, and it tends to get explained as security fatigue or a training problem. Sometimes it is. Often it is simply people responding sensibly to a system that never answered them.
Closing the Loop
Acknowledge every report, quickly
The fix is mostly about responding, and it is cheaper than most of what an awareness budget gets spent on, starting with the first reply. Every report should get an immediate acknowledgment that it arrived and that a person will look at it. An automatic reply is fine for this first step, as long as it is followed by something real. The goal is that nobody ever wonders whether their report went anywhere.
Tell people what it turned out to be
This is the step that changes behavior. A short note saying “this was a real phishing attempt, and we removed it from 37 other inboxes because you reported it” is the most powerful piece of security training most employees will ever receive. It tells them their action mattered and shows them what an attack looked like, in their own inbox, at the moment they are paying attention.
A note saying “this one was a legitimate marketing email, and thank you for checking” matters almost as much. It keeps the door open, and it tells the person their judgment is welcome even when the answer is benign.
Give the mailbox a named owner
Reported email needs an owner by name and a target for how quickly reports get reviewed. If the volume is too large for one person, that is a reason to add tooling to sort the obvious cases, and not a reason to let the mailbox fill up. A mailbox with no owner is the most common reason this whole loop breaks.
Thank people for false alarms
The fastest way to end reporting is to make someone feel silly for raising a concern that turned out to be nothing. Every false alarm is a person practicing exactly the behavior you need on the day it matters. Our piece on blameless reporting makes the case for removing punishment, and this is the gentler version of the same principle: remove embarrassment too.
Share the catches
Once a month, tell the whole organization about a report that caught something real, and with their permission, name the person who made it. Stories travel further than policies, and seeing a colleague recognized for reporting does more for the next report than another training module.
Measure the time to an answer
Most organizations measure how many people report. Add a second number: how long it takes a reporter to hear back about what their report turned out to be. If that number is measured in weeks, or never, you have found the reason the first number is falling. We cover the wider set of measures in security culture metrics.
The Same Scheduler, a Different Week
Picture the scheduler from the beginning, clicking report on the strange billing email. Two minutes later a note arrives: it was a real attempt to steal logins, it reached forty people in the practice, and because she reported it, it has been removed from every one of their inboxes.
She will report the next one, and when her colleague leans over to ask whether anybody reads these, she will say yes, and she will mean it. Nothing about her changed between the two versions of this story. The only difference was whether somebody answered.
Marie Welch is Director of Behavioral Security Operations at Grab The Axe.
With a dual background in I/O Psychology (PhD Candidate) and Business Management (MBA), Marie bridges the gap between clinical rigor and operational strategy. She oversees B2B relations, compliance, and the 'business' of risk management.
View Author Page →
