Incident Reporting

What Counts as a Security Incident?

A security incident is anything that could harm the confidentiality, integrity, or availability of company data or systems. That includes:

Definitely report:

• Clicked a suspicious link or opened a suspicious attachment
• Computer acting strangely (slow, pop-ups, strange programs)
• Lost or stolen device (laptop, phone, USB drive)
• Shared password or credentials by mistake
• Received a suspicious phone call asking for information
• Found a USB drive and plugged it in
• Gave information to someone you now suspect was impersonating a colleague
• Noticed unauthorized access to your accounts
• Received an email that was clearly phishing

Also report:

• Something just "feels off" about an email or request
• A colleague mentioned they clicked something suspicious
• You noticed someone without a badge in a secure area
• You think you might have made a mistake, but you're not sure

The rule: When in doubt, report it. False alarms are better than missed attacks.

Immediate Containment Steps

If you think you've clicked something bad or your device is compromised:

Step 1: Disconnect from the network

On laptop:

• Turn off WiFi (most laptops have a function key or settings toggle)
• Unplug ethernet cable if connected

On phone:

• Turn on Airplane Mode

Why? This prevents potential malware from spreading to other systems or sending data to attackers.

Step 2: Don't try to fix it yourself

❌ Don't restart your computer (destroys evidence) ❌ Don't delete suspicious files (might make it worse) ❌ Don't install antivirus yourself (might not catch it) ❌ Don't wait until Monday to report (attackers work weekends too)

The IT security team has proper tools and training. Let them handle it.

Step 3: Report immediately

Tell your IT security team or manager:

• What happened (I clicked a link in this email)
• When it happened (about 20 minutes ago)
• What you noticed (computer became slow, saw pop-ups)
• What you did (I've disconnected from WiFi)

Step 4: Document what you remember

While it's fresh in your mind, write down:

• The email address that sent the message
• Subject line of the email
• What the link or attachment looked like
• Anything unusual you noticed afterward
• Approximate times of each event

This information helps the security team investigate quickly.

Who to Contact

Your first call should be:

1. IT Security Team / Helpdesk — Most companies have a dedicated security email or phone line
2. Your manager — If you can't reach IT
3. Any IT staff — If it's urgent and you can't reach your manager

Find out NOW (before you need it):

• What's your company's security reporting email?
• What's the IT helpdesk number?
• Is there an after-hours security contact?

If you don't know these, ask today. Don't wait until you're in a panic.

What Happens After You Report

Within minutes:

• Security team assesses the report
• They may ask you for more details
• They start investigating

Within hours:

• Your device may be collected for analysis
• You'll get a replacement if needed
• Security team identifies the scope of the incident

Within days:

• Investigation completes
• You'll be told what happened (if appropriate)
• Lessons learned are shared (without naming individuals)

What WON'T happen:

• You won't be in trouble for reporting
• You won't be blamed for making a mistake
• You won't be embarrassed publicly

Every company with good security culture knows: punishing people for reporting means people stop reporting. That's far more dangerous than any single incident.

The First Hours Are Critical

In cybersecurity, time is everything. Here's what typically happens after a successful phishing attack:

Every minute you delay reporting gives attackers more time to do damage.

Real Example: Colonial Pipeline (2021)

An employee's compromised password (discovered in a data breach) was used to access the company's VPN.

Timeline:

• Attackers gained access on a Friday
• Attack wasn't detected until Sunday
• By then, attackers had deployed ransomware across the network

Result:

• 6-day pipeline shutdown
• Fuel shortages across US East Coast
• $4.4 million ransom paid
• $90+ million in total damages

What could have helped: Earlier detection. If an employee had noticed unusual activity and reported it, the attack might have been contained before ransomware deployment.

Small Incidents Can Be Part of Larger Attacks

What seems minor might be reconnaissance for a bigger attack.

Scenario 1: You receive a test phishing email that you correctly identify and delete. But you don't report it.

What you don't know: 50 other employees received the same email. 3 clicked the link. If everyone reported, the security team would see a coordinated attack and respond appropriately.

Scenario 2: You get a strange phone call from "IT support" but you hang up without giving any information. You think nothing of it.

What you don't know: The attacker is calling multiple employees, fishing for one person who will comply. Your report could trigger a company-wide warning that prevents a successful attack.

Pattern Recognition

Security teams are looking for patterns:

• Multiple similar phishing emails
• Unusual login attempts from the same location
• Several employees getting suspicious calls

Your single report might be the piece that connects the dots.

The No-Blame Culture

Many people don't report incidents because they're embarrassed or afraid of consequences.

What people worry about:

• "I'll look stupid for clicking that link"
• "I'll get in trouble with my manager"
• "It'll affect my performance review"
• "Everyone will know I messed up"

The reality in good organizations:

• Security teams know anyone can be fooled
• Attackers are sophisticated professionals
• Reporting is valued, not punished
• The real mistake is not reporting

Real Example: Maersk (2017)

The shipping giant Maersk was hit by NotPetya malware. Within hours, their entire global operation was frozen — no emails, no phones, no ability to process shipments.

An employee noticed unusual behavior early and reported it. While the attack still caused massive damage, that early report helped the security team understand what was happening faster.

Maersk's response: The company publicly praised employees who reported quickly. No one was blamed for the initial infection — they were attacked by nation-state malware designed to be unstoppable.

When Reporting Saved Organizations

Twitter (2020): Employees reported unusual account activity, enabling the security team to respond quickly to what became a major breach. Early reports limited the damage.

Uber (2022): When an attacker gained access through a compromised contractor, employee reports of unusual messages helped the security team identify the breach within hours.

Your Company: Every time someone reports a suspicious email, a strange phone call, or an unusual request — they're protecting everyone. Most of these reports don't turn into major incidents. But the one that does? That's the one that matters.

The Bottom Line

1. Report immediately — Minutes matter
2. Report everything — False alarms are welcome
3. No blame — Reporting is always the right choice
4. Disconnect first — Contain the damage
5. Document what you know — Help the investigation

The single most important thing you can do after a security incident isn't technical — it's picking up the phone (or sending that email) and saying: "I think something happened."

That simple act could save your company millions of pounds and months of recovery.

You're not expected to be perfect. You're expected to report.