Reports their own mistakes quickly

Tells the security team right away after clicking a link, opening a file, or entering a password on a suspicious page.

Minutes matter after a compromise. People only admit mistakes where it feels safe to do so; fear and shame make them hide the click.

How to observe it: Self-reports after a click in Simulations; median time from click to self-report.

Supporting evidence

• Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital Tolsdorf et al., 2025
• Psychological Safety and Learning Behavior in Work Teams Edmondson, 1999

Context

• "I didn't click": What users say when reporting phishing Pilavakis et al., 2023