Breaking the Silence Sparks Courage and Action in Reporting Breaches

Picture this: You’re a social media manager working late when suddenly your company’s official X account posts a strange message you didn’t send. At the same time, unusual pop-ups and network activity appear on your computer. Panic sets in. Did I cause this? Have we been hacked? Should I report it? Will I be blamed or even lose my job? These fears often lead people to stay silent, hoping the issue will resolve itself.

Unfortunately, such anxiety is a widespread issue across the industry. Many hesitate to report breaches due to fear of punishment or blame, creating a major barrier to swift and effective incident response. When leadership prioritises finding a “fall guy” over immediate action, critical threats go unnoticed, resulting in greater damage and higher costs.

Why This Situation Happens: A Culture Rooted in Blame

This fear arises because many workplaces focus more on finding someone to blame than on resolving the problem quickly. Employees often see reporting an issue as admitting fault, which could damage their reputation, risk their job, or expose them to legal trouble. Management may unintentionally reinforce this tendency by emphasising blame over speedy containment and recovery.

Silence Increases Risk

When employees lack the confidence to voice their concerns, they conceal issues and postpone reporting. This silence allows threats to escalate, causing greater damage. Disconnected teams working in silos worsen the situation by withholding information or shifting responsibility instead of collaborating, leading to slower detection and response.

This was evident in July 2023, when Kenya suffered a Distributed Denial of Service (DDoS) attack that disrupted key government and financial services for more than four days. Fear of blame delayed communication and teamwork, allowing the attackers to prolong the disruption. Millions of citizens relying on these services felt the impact deeply.

How can we solve this?

1. Focus on Shared Responsibility, Not Blame — Promote accountability as a collective effort aimed at learning and improvement rather than punishment.
2. Encourage Openness and Early Reporting — Make employees feel safe and valued when they raise concerns promptly.
3. Break Down Silos — Foster strong communication and teamwork across departments for faster, unified responses.
4. Provide Anonymous Reporting Channels -Allow staff to report suspicious activity confidentially to reduce fear of retaliation.
5. Recognise Transparency — Reward and appreciate employees who actively report cyber security issues.
6. Invest in Ongoing Training — Use realistic exercises and education to build confidence in identifying and reporting threats.
7. Leadership’s Role — Leaders should create and implementing a safety net, assuring staff that reporting leads to solutions, not punishment.
8. Maintain Continuous Awareness — Keep teams informed about evolving threats and cyber security best practices.

Why It Matters

Cybersecurity is everyone’s responsibility. When stakeholders feel empowered and supported to report security concerns, they become proactive defenders instead of passive observers. Creating a culture of openness and teamwork significantly strengthens an organization’s defences against cyber threats.

With Cyber security Awareness Month approaching, it’s an opportunity for your organisation to reassess its cyber security culture and eliminate the barriers that prevent timely incident reporting. By fostering trust, collaboration, and shared responsibility, they can better protect vital systems and data from emerging cyber risks.