The most expensive phrase in cybersecurity: “It’s probably nothing.”

When a small warning becomes a big incident 

Security incidents rarely begin with an obvious alarm. More often, they start with subtle warning signs: an employee receives an unusual message, notices an unfamiliar login, observes unexpected file behaviour or experiences a sudden slowdown in system performance. The first reaction is often not to report the incident, but to assume that it is probably nothing.

This hesitation can have significant consequences. In cybersecurity, time plays a critical role. The decisive moment is often not when a system is compromised, but when suspicious activity is reported. The earlier a potential threat reaches the responsible security team, the more opportunities there are to investigate, contain and recover from an incident.

Reporting does not mean diagnosing an incident. It means communicating a potential threat to someone who can assess it. A report that turns out to be harmless may only require a few minutes to investigate. An unreported incident that turns out to be genuine can result in costs of hundreds of thousands.

Why do people wait before reporting? 

The reasons are often less technical than organisations expect. One of the most common barriers is uncertainty: employees may believe they need to know exactly what happened before reporting suspicious activity.
Others hesitate because they fear being blamed for clicking a link or opening an attachment, or because they do not want to waste the security team’s time with a false alarm. Waiting for more information may seem responsible, but every minute of delay can give attackers more time to operate, particularly as AI-driven attacks become increasingly automated.

Complex reporting processes create additional barriers. If employees need to find the correct email address, complete a lengthy form or navigate an unfamiliar ticketing system, they may postpone reporting. What starts as a delay can result in an incident never being reported.

Previous experiences also influence reporting behaviour. If earlier reports received no feedback or colleagues were criticised for raising false alarms, employees may become reluctant to report future concerns. Combined with alert fatigue and unclear responsibilities across IT, security and business teams, these factors can further delay incident reporting.

The earlier employees report suspicious activity, the greater the chance of keeping a small security incident small.

In Switzerland, reporting is now a legal deadline 

Timely reporting is no longer only a matter of security culture. It is also a regulatory requirement for certain organisations.

Since 1 April 2025, operators of critical infrastructure in Switzerland have been required to report cyberattacks to the National Cyber Security Centre (NCSC) within 24 hours of discovery, with a further 14 days to complete the report. Since 1 October 2025, failure to comply with the reporting obligation can result in fines of up to CHF 100,000.

Under the GDPR, a 72-hour notification period applies to many personal data breaches, while sector-specific regulations may impose additional deadlines.

For an increasing number of organisations, the time between identifying suspicious activity and reporting it is therefore not only an internal security metric but also a compliance consideration.

How to shorten the reporting window 

Organisations that consistently report incidents earlier share several common practices.
They establish a non-punitive reporting culture and communicate this clearly across all levels of the organisation, starting with leadership. They provide a simple, well-known reporting channel, such as a dedicated email address, a chat function or an integrated reporting feature within everyday tools. This makes it easier for employees to raise concerns without unnecessary effort.
They also keep initial reporting requirements simple. Information about what happened, when it occurred and what the employee observed is usually sufficient to begin an assessment.
Providing feedback is equally important. When employees understand what happened after submitting a report, it reinforces positive reporting behaviour and builds trust in the process.
Regular training and practical exercises help make these procedures part of everyday operations. Awareness training should cover not only how to recognise phishing attempts but also which early warning signs require escalation.

Tabletop exercises and simulated incidents allow employees to practise reporting decisions before a real security event occurs. Measuring mean time to report as a key performance indicator helps organisations track progress and maintain management attention.
Technology also supports faster reporting. Centralised logging, SIEM and SOAR platforms, endpoint telemetry and integrated reporting functions can reduce the time between identifying a suspicious signal and taking action.

However, technology cannot replace human awareness. Employees are often the first to notice suspicious supplier requests, unusual phone calls or other activities that automated security controls may not detect.
The most effective approach combines both capabilities: automated systems correlate signals quickly, while employees provide the context needed to assess potential threats.

Effective incident reporting follows a simple sequence. The challenge is not building the process, but ensuring employees use it immediately when something suspicious occurs.

More resilience through faster reporting

Looking ahead