Reporting Culture

What Is Reporting Culture?

A colleague tells the team he typed his password into a dud signing page, is changing it, and sees no need to involve security. It is not your incident, and you report it anyway. You file only what you know, then watch from the attacker's side what the password change leaves untouched: a live session and a mail forwarding rule. You'll leave knowing why a bystander's report sets how long an attacker gets to work.

What You'll Learn in Reporting Culture

• Report a colleague's security slip even when they say it is handled
• Write a report that states only what you know, without blame or theory
• Explain why a password change does not end an existing session
• Find and remove a mail forwarding rule an attacker left behind
• Recognize that reporting time, not detection tools, sets the attacker's window

Reporting Culture — Training Steps

1. Marcus Talks Himself Out of It

   A message lands on the operations list. It is not addressed to you, and the person who sent it has already decided it is nothing.

2. Three Things Marcus Is Assuming

   Every sentence in that message is a reason not to report. Look at what each one takes for granted.

3. Open the Reporting Portal

   It is not your incident, you have no proof anything happened, and Marcus has said he does not want it escalated. Report it anyway. Sign in to the portal.

4. File What You Actually Know

   Write down what happened and nothing else. No theory about whether the page was real, no judgement of Marcus, no apology for possibly wasting anyone's time. Times and facts are what make a report actionable.

5. Why That Report Is Useful

   The value is not that you raised an alarm. It is that a responder can act on this without calling anyone first.

6. What the Password Change Fixed

7. He Was Already In

   Bob collected the password at 11:40 and used it at 11:47, six minutes after Marcus's email to the list, while everyone treated the matter as handled. The password change at 12:10 logged nobody out.

8. What He Reads First

   He does not browse. He searches for money, and the top of the inbox is already holding some.

9. Eighty-Four Thousand, Pending

   A supplier has just changed their bank details by email, and the payment has not gone out yet.

10. Persistence Costs Him Nothing

    Access can be taken away. A rule he leaves behind cannot, unless somebody goes looking for it.