People need a safe way to report mistakes quickly
Fast reporting needs to be easier than staying quiet, and free of consequence.
One obvious route, no form, no explanation required, no blame. Anything slower or more uncomfortable competes with the entirely rational option of hoping nothing comes of it. The minutes between the click and the report are frequently the difference between an inconvenience and an incident.
More on Human factors
- Phishing exploits context, not stupidityIt fitted the gap
- A warning ignored every day stops being a warningThe bell nobody hears
- Security friction moves behaviour elsewhereSqueeze it here, it comes out there
- MFA fatigue weaponises repetitionAsk forty times
- Verify suspicious requests through a separate channelRing back on a line they never gave you
- Security training decays without practiceWhat you knew in March