Answers every report with fast, positive feedback

Why it matters

People report mainly to protect coworkers and want to know the outcome. Evidence on rewards is mixed: one field study found incentives added little, so feedback should inform, not just reward.

How to observe it

Share of reports that get a response; median response time; repeat reporting by the same people.

Evidence

Supporting (2)

• Phishing reporting in organizations: What motivates employees to take action?
  Burda et al., 2025 Supports

  The main reason employees report suspicious emails is wanting to protect and help the organization and coworkers, followed by responsibility, awareness of consequences, and feelings of insecurity. Reporters were more likely to report convincing, well-impersonated emails, showing they judge potential impact.

• "I didn't click": What users say when reporting phishing
  Pilavakis et al., 2023 Supports

  People who report suspected phishing typically describe evidence they noticed, possible impacts, what they did or did not do, and questions they have. Some build clear arguments for why the email is phishing and why the organization should act.

Challenging (1)

• Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training
  Lain et al., 2024 Mixed

  Whatever benefit embedded training has comes from the nudge of being periodically reminded of the threat, not from the training content, which employees rarely read. Delaying training was as effective as immediate training, rewards did not improve behavior, and phishing looked like an attention problem rather than a knowledge problem.