Breaking the silence: The psychology behind cyber security incident reporting

TLDR: Recent research reveals that 39% of UK workers wouldn’t report a cyber attack, primarily due to fear of blame and embarrassment. This silence costs organizations an average of 58% more per breach and creates systematic vulnerabilities that undermine even the strongest technical defences.

A troubling statistic emerged from recent research by Cohesity that should concern every business leader: two in five UK office workers wouldn’t tell their company’s cyber security teams if they suspected they’d been the victim of a cyberattack at work. Even more concerning? This silence persists despite 79% of British employees feeling confident they can identify cyber attacks, and the UK showing better cyber security understanding than other European nations.

Source: Craig Hale, TechRadar – “Many workers wouldn’t tell their bosses if they’d been hit by a cyberattack“

This revelation connects directly to our earlier exploration of social engineering psychology. The same psychological vulnerabilities that make us susceptible to sophisticated scams also prevent us from seeking help when we need it most.

The psychology of fear: Why smart people stay silent

The research reveals three primary psychological barriers preventing incident reporting:

Fear of blame and embarrassment drives the majority of silence. Coesity’s findings show that 17% of workers avoid reporting due to fear of being blamed, another 17% worry about getting into trouble, and 15% simply don’t want to cause a fuss. This fear response is deeply rooted in our psychology, the same shame and self-preservation instincts that social engineers exploit.

The “fix It myself” mentality affects 11% of employees who would rather attempt to resolve issues independently than notify IT. This reflects cognitive biases including overconfidence in our abilities and underestimation of threat severity, the very biases that make social engineering attacks successful.

Social and cultural pressures create additional barriers. When incident reporting is rare within an organisation, social proof effects discourage individual reporting. Employees conform to perceived norms around “not bothering” cyber security teams, creating cultures of silence that compound vulnerabilities.

The true cost of silence

IBM’s latest research reveals the staggering financial impact of delayed incident reporting. According to their 2024 Cost of Data Breach Report:

• Breaches lasting longer than 200 days cost 34% more than those contained quickly
• Organisations with strong incident response cultures save an average of $2.03 million per breach
• Internal detection (enabled by employee reporting) provides $1 million in cost savings while reducing breach lifecycle by 61 days

Olivier Savornin from Cohesity emphasises the severity: “Staying silent if they suspect a malicious cyberattack is quite possibly the worst thing an employee could do.” 

This isn’t hyperbole – it’s mathematical reality based on thousands of breach investigations.

Building psychological safety in cyber security

Creating an environment where employees feel safe reporting incidents requires systematic cultural transformation:

Leadership behaviours that build trust

Frame incidents as learning opportunities: Leaders must consistently position security events as chances for system improvement rather than individual failures. This requires shifting language from “who did this?” to “what can we learn?”

Model vulnerability: When leaders admit their own mistakes and near-misses, they create permission for others to do the same. Psychological safety flows from the top down.

Demonstrate curiosity over judgment: Ask questions focused on understanding and improvement rather than fault-finding. This creates an investigative rather than punitive atmosphere.

Structural changes that support transparency

Implement “just culture” principles: Separate incident response from disciplinary processes. Focus on systematic improvements rather than individual punishment for good-faith reports.

Create multiple reporting channels: Offer anonymous options, clear escalation procedures, and dedicated incident response teams that employees trust.

Conduct blameless post-mortems: Share incident details as learning opportunities while recognising reporters as positive examples of security-conscious behaviour.

Practical steps for immediate implementation

For leadership teams:

1. Assess current culture: Survey employees about their comfort level reporting security concerns
2. Establish clear messaging: Communicate that “we report to learn, not to blame”
3. Invest in training: Focus on behaviour change rather than compliance checkbox exercises
4. Measure and iterate: Track reporting rates, response times, and employee engagement as key performance indicators

For HR and communications teams:

1. Develop trust-building messages: Emphasise shared responsibility and collective improvement
2. Create recognition programs: Celebrate employees who report incidents as security champions
3. Provide ongoing reinforcement: Use regular micro-learning sessions rather than annual training events

For IT and security teams:

1. Streamline reporting processes: Make incident reporting as easy as possible
2. Provide immediate support: Respond quickly and supportively to all reports
3. Share success stories: Communicate how employee reports led to improved security

The connection to social engineering vulnerability

The psychological factors preventing incident reporting are identical to those exploited by social engineers. Both involve:

• Authority dynamics that discourage questioning
• Social proof effects that normalize risky behaviour
• Cognitive biases that distort risk assessment
• Emotional manipulation through fear and shame

Organisations addressing the psychology of incident reporting simultaneously strengthen defences against social engineering attacks. It’s a dual benefit that compounds over time.

Building long-term resilience

Creating a psychologically safe cyber security culture isn’t a destination, it’s an ongoing journey requiring sustained attention and adaptation. The most successful organisations view this as fundamental business infrastructure, not a “nice-to-have” HR initiative.

Organisations that invest in psychological safety achieve 50-60% reductions in breach costs while building cultures of learning, trust, and resilience. The human element of cyber security isn’t just important, it’s often the determining factor between resilience and catastrophic failure.

The transformation from silence to transparency requires courage, commitment, and systematic change. But the alternative; Maintaining cultures of fear that prevent our most valuable security assets (our people) from helping us, is far more dangerous than any technical vulnerability we might face.

If you’re not sure how your team would react right now, that’s usually the risk.

We can sense-check it with you. No pressure, just clarity: 

https://blackswancyber.co.uk/contact-us/

For more insights on cyber security psychology and human-centered security approaches, explore our social engineering psychology analysis and discover how understanding human behaviour strengthens our defences.