A phishing reporting culture is what you get when the majority of staff report suspicious email unprompted — and it is the single behaviour that neutralises real attacks, because filters miss things and a report within minutes closes the window an attacker has to act. It is built, not announced: seven steps turn reporting from an optional nicety into the default reflex. This page walks through them, the two failure modes that kill reporting, and how to measure the culture once it exists.
TL;DR
- Report rate is the metric that matters more than click rate — clicks measure mistakes, reports measure the reflex that saves you.
- The reflex is built by seven steps: easy button, no-blame policy, public praise, real broadcast, leader participation, speed measurement, and monthly measurement.
- Two failure modes kill it: punishing a click, and making reporting take more than a minute.
- A 50%+ report rate is a realistic year-one target; rising report rate is the earliest signal the culture is working.
- Cyber Aware's benchmark: report rates climb past 50% by month eight on monthly programmes.
Why report rate beats click rate
Click rate measures failure; report rate measures the control that works. An email that got clicked but also got reported by a colleague is an email IT can purge from every other inbox within minutes. An email that went unclicked and unreported is a silent miss — the same lure may land in fifty more inboxes tomorrow, and nothing has improved.
The stakes are not abstract. In FY2024–25 the ASD's ACSC received more than 84,700 cybercrime reports — one every six minutes — and business email compromise was 15% of business cybercrime reports (ASD, Annual Cyber Threat Report 2024-25). BEC starts with one convincing email in one inbox; the control that stops it spreading is a person who hits report instead of reply.
The seven steps
- Make reporting take under a minute. A report button in the mail client beats a forward-to-IT address beats a phone call. If reporting needs a ticket, staff will not bother — they will delete, which is worse than clicking.
- Adopt a no-blame policy and mean it. The moment anyone is disciplined for clicking, reporting dries up — people hide mistakes rather than surface them. Say the policy in the first campaign announcement and never break it publicly.
- Praise reporters publicly, coach clickers privately. A named shout-out after each campaign ('Sarah reported the fake payroll email in 40 seconds') builds the reflex faster than any training module. Per-person coaching happens one-to-one, never in a forum.
- Broadcast real reports internally. When a genuine suspicious email hits the company, tell everyone within the hour: what it looked like, what the tell was, who caught it. Nothing teaches faster than a live example that just landed in their own inbox.
- Run leadership through the programme. When the managing director appears in the same simulation statistics, reporting stops being an IT chore and becomes a company habit.
- Measure time to report, not just volume. A report that arrives after the attack is stale. Track median minutes-to-report per campaign and celebrate the fastest catch, not the loudest complainer.
- Put the numbers on a monthly trend. Report rate, click rate and time-to-report on one chart. A culture you do not measure drifts; a culture on a trend gets managed. Human risk reporting is that chart.
The two failure modes
| Failure mode | What it looks like | The fix |
|---|---|---|
| Punishment | Someone is called out for clicking a simulation; reports halve next month | Never. Coach privately, praise reporters, keep the no-blame rule visible |
| Friction | Reporting means emailing IT, describing the message, attaching a screenshot | Deploy a one-click report button; under a minute or it does not happen |
Watch for a third, quieter one: report quality dropping while volume stays high. It usually means people are mass-reporting to look engaged — tighten with training on what a genuine suspicion looks like, not with friction.
What good looks like, by month
Cyber Aware's benchmark from monthly programmes: report rates climb past 50% by month eight, alongside an average 80% reduction in clicked links (phishing simulations). The industry baseline makes the climb legible — 33.2% of untrained staff click a malicious email, falling to 4.2% after twelve months of continuous training and testing (KnowBe4, 2026 Phishing by Industry Benchmarking Report). Report rate rising is typically visible from month two, well before the click curve bottoms out.
A realistic year-one sequence: report rate above 30% by month three, above 50% by month eight, time-to-report under ten minutes by year end. Each milestone is a story for the leadership brief — the same one-pager structure used in human risk reporting.
How to start this month
- Deploy the report button if one does not exist — it is step one for a reason.
- Send a one-paragraph no-blame policy from the most senior person in the company, not from IT.
- Run one simulation and celebrate the first three reporters by name.
- Broadcast the first real report internally, whatever it is.
Four actions, one month, and the reflex starts forming.
FAQ
What is a good phishing report rate? Above 30% is a functioning culture; above 50% is a strong one. Rising month over month matters more than any single figure.
Should we reward reporting? Recognition, yes — public praise costs nothing and builds the reflex. Cash rewards for reports tend to generate noise; recognition generates habit.
What if reporting volume is high but quality is low? Mass-reporting is usually engagement theatre or genuine confusion. Train the six-second check (sender, link, context) so reports carry signal, and never respond with friction.
Does a reporting culture really stop real attacks? It shortens them. A real phish reported within minutes gets purged from other inboxes before the second person clicks — that is the entire defensive value.
How do we keep it from fading? Monthly measurement. The trend line keeps the habit visible, and the leadership brief keeps it funded.
One last thing
The first time a real attack is caught by an employee report — not a filter, not IT — say so publicly and thank the person by name. That single story does more for the culture than any policy document.