After several employees were disciplined for clicking phishing links, staff have stopped reporting suspicious emails, and the security team now learns of compromises only days later. Which action would BEST restore timely reporting?
Select an answer to reveal the explanation.
Short Explanation
Picture a smoke alarm that gives you a shock every time it goes off: pretty soon you pull the battery. That's what punishing reporters does, and the fix is making it safe and even rewarding to raise your hand early. Don't fall for the monitoring answer; it finds clicks, but it doesn't bring your human sensors back.
Full Explanation
Early detection of social engineering depends heavily on people reporting what they see, and people report only when doing so is safe. Disciplining those who admit to a click teaches the whole workforce that silence is the rational choice, which is exactly the delay the security team is now experiencing. A non-punitive reporting policy, visibly endorsed by senior leadership and backed by recognition for prompt reporting, removes the fear and restores the flow of early warnings. More frequent simulations with mandatory retraining after each failure add another penalty and are likely to deepen the reluctance to come forward. Automated click detection is a reasonable technical layer, but it does not address the stated problem; the question is about restoring reporting behavior, and monitoring will miss compromises that occur through channels it cannot see. Publicizing the disciplinary policy reinforces the very consequence that caused the silence. Exam caveat: non-punitive does not mean no accountability; repeated negligence or deliberate misconduct can still be handled through HR, but honest mistakes reported promptly should not be. Operational check: track time from suspicious email receipt to report and the volume of voluntary reports before and after the policy change.