Give a small team a year of email and someone will click on something they shouldn’t. Not because they’re careless, but because the job involves opening messages from strangers, and the fakes are good now. So the thing you can actually influence isn’t whether it happens. It’s how long it takes you to hear about it. That gap is where the damage happens. In the hour after a click, an attacker may be reading the mailbox, setting up a rule to forward copies of new mail, and looking for an unpaid invoice to redirect. Someone who reports in ten minutes gives you a bad morning. Someone who waits until Monday because they’re embarrassed gives you a breach. Embarrassment is the variable, and it’s one you control. Blameless reporting means the person who reports a problem is never treated as the problem. The problem is whatever let the message through. That isn’t softness. It’s the only arrangement that gets you the information fast enough to act. One obvious way to report. A named point person, an email address, and a phone number. Not “tell IT” when there is no IT department. A stated expectation. For example: “Tell Dana immediately, any hour, even if you’re not sure.” Visible permission from the top. Leaders talking openly about their own near misses does more than any training module. Thanks for false alarms, out loud. Someone who forwards a suspicious email that turns out to be legitimate just gave you a free test of the process. Treat it as a win, or you won’t get the next one. Punishing a report. Do it once, and the reporting stops, and it stops for everyone who saw it happen. The same goes for using simulated phishing results as discipline. Practice exercises are useful for learning. Used as a scorecard, they teach people that the safest thing to do after a mistake is to stay quiet. The person receiving reports doesn’t need to be technical, but they should know the first few steps: Change the password for the affected account, and sign it out of every device. Make sure multifactor authentication is on. Check the mailbox for forwarding rules nobody set up on purpose. If a payment or bank change was involved, call the bank straight away. Bring in your IT provider, if you have one. Then thank the person who reported it, and mean it. Name the person, put the expectation in writing, and have leadership be the first to report something. That closes Section 2. Next: protecting your data, starting with the share link nobody went back to check.Why speed is the whole game
What “blameless” means
How to build a blameless reporting culture
What undoes all of it
What the point person does next
This week’s action
