People are not the weakest link. Let’s get that sorted straight away.
Calling them an “early-warning system” also shouldn’t mean giving them another job on top of the one they’re already doing.
Your receptionist isn’t a threat analyst. Your accounts assistant shouldn’t have to investigate a suspicious email and nobody should arrive at work worrying that one wrong click will make them responsible for bringing the business down.
But people do notice things. A supplier asking for something unusual. A message that doesn’t sound like the colleague who supposedly sent it. A payment request that doesn’t fit the normal process.
The question is whether your workplace makes it easy to mention those concerns.
That is a management issue, not a staff vigilance issue. Here are five places to start.
1. Make “thanks for telling me” the first response
When somebody says, “I think I’ve clicked something I shouldn’t have,” what happens next matters.
If they get a sigh, a lecture or “Didn’t you do the training?”, don’t be surprised if they’re reluctant to speak up next time.
Start with: “Thanks for telling me. Let’s get it checked.”
That applies whether they’ve spotted something before acting or realised afterwards. People need to know that an honest mistake won’t turn into public humiliation.
You can review what happened once the immediate problem is being handled. Look at the process, the workload and the safeguards too, rather than stopping at the person who clicked.
2. Give people permission to question the boss
It’s easy to tell staff to challenge suspicious requests. It’s harder if the managing director gets irritated whenever anybody questions theirs.
If your usual instruction is “Just get it paid”, a poster telling accounts to stop and check won’t carry much weight.
Leaders need to make the expectation clear: “If a request needs checking, check it. Even if it appears to come from me.”
Then back that up when a genuine payment takes a little longer because someone followed the agreed checks.
Culture starts in the CEO’s office, but it needs to reach the caretaker’s cupboard. Nobody should need a particular job title to raise a concern.
3. Make reporting a quick handover, not an investigation
“Report anything suspicious” is only useful if people know how, and somebody is available to respond.
Provide a simple reporting button, a named contact or a clearly explained route to your IT provider. Include an alternative if email itself is the problem.
Staff shouldn’t have to prove that something is malicious before asking for help. “I’m not sure about this” is enough.
Their job is to pass on the concern. The organisation’s job is to get it assessed and handled.
Close the loop afterwards, too. Even a brief “We’ve checked it; it’s genuine, and you were right to ask” helps people understand that reporting wasn’t a waste of anybody’s time.
4. Make learning part of work, not another pressure
Give people time during their working day to learn and ask questions. Don’t squeeze training between an impossible deadline and a ringing phone, then criticise them for rushing it.
Keep examples relevant. An accounts team might discuss a supplier bank-detail change. School office staff might talk through an unexpected document apparently sent by a headteacher.
Ask what would make the situation difficult and what help they’d need. Their answers might reveal a confusing procedure or a missing contact, rather than a gap in knowledge.
If you use simulated phishing, use it to improve support and safeguards. No public league tables. No naming and shaming. No “gotcha”.
5. Show that management is doing its share
Asking staff to speak up creates an obligation to listen and act.
If people repeatedly report the same problem, investigate why it keeps reaching them. If a security process makes their work unnecessarily difficult, involve them in improving it.
Keep investing in technical protection and workable procedures. Training doesn’t replace those, and employees shouldn’t be expected to compensate for gaps in them.
Look beyond how many people clicked a test email. Ask whether staff know where to get help, whether reports receive a useful response and whether people feel comfortable admitting a mistake.
A quiet reporting inbox isn’t, by itself, proof that everything is fine.
Start with the response people expect
You don’t build a supportive security culture by telling everyone to be more careful.
You build it through everyday decisions: allowing time to check, responding calmly, listening to concerns and fixing things that make safe working difficult.
The aim isn’t to turn every employee into a cyber expert. It’s to make “Can you have a look at this?” an ordinary, welcome part of the working day.
