An Employee Reported Something Suspicious. What Happens Next?

Gary Perkins, Chief Information Security Officer

Key Takeaways

• Employees should report suspicious activity promptly, even when they are unsure whether they clicked a link, entered credentials, or approved an unexpected authentication request. 
• A clear reporting process and a culture that does not punish honest mistakes help prevent delays that could allow an incident to escalate. 
• Employees should stop interacting with suspicious content, preserve potential evidence, and follow instructions from IT or security. 
• Security teams need established procedures to investigate reports, determine whether suspicious activity has affected other accounts or systems, and take appropriate action to contain the threat.

Cybersecurity Awareness Month often focuses on helping employees recognize phishing emails, suspicious links, and risky attachments. But recognizing a potential threat is only the first step. What happens after an employee reports something suspicious deserves just as much attention.

The way an organization responds can make a significant difference in how an incident unfolds. Rapid reporting gives the security team a chance to investigate, limit potential damage, and determine whether suspicious activity has affected other people or systems. When a compromise has occurred, a delayed report gives the attacker more time to act.

Make Reporting the Easy Part

Even employees who know what to look for can make a mistake. They might click a link, open an attachment, enter their credentials on a convincing website, or approve a request they later realize was unusual. Then comes the hesitation. 

Employees may feel embarrassed or worry they’ll be blamed for making a mistake. Some spend time trying to determine whether anything actually happened before telling someone. 

That delay can cause more damage than the original click. 

Employees need to understand that reporting a potential incident is the right thing to do, even when they are unsure what happened. They should never feel they need to prove something is malicious before raising a concern. Recognizing that something feels wrong is enough to start the process. 

Organizations should make it clear what employees should report, where to report it, and how to do so. That includes suspicious emails, unexpected login prompts, unusual system behavior, unfamiliar MFA requests, unexpected password changes, and anything else that seems out of place. 

Just as importantly, employees need to know that their organization values prompt reporting, even when they’ve made a mistake. The goal is to involve the right people as quickly as possible, not to assign blame.

What Should An Employee Do After Noticing Something Suspicious?

Employees should stop interacting with suspicious content and report it promptly to IT or security using the organization’s established reporting process. 

The first step is to report it to IT or the security team using the organization’s established reporting process. That might involve a phishing report button, a dedicated phone number, a security email address, or an incident reporting portal. 

If the employee clicked a link, opened an attachment, entered credentials, or approved an unexpected authentication request, they should say so. If they are unsure whether they clicked, they should report that uncertainty, too. In practice, when someone says, “I don’t know if I clicked it,” the security team should treat the possibility that they did as real until it can be ruled out. Waiting for certainty wastes valuable time. 

They should stop interacting with the suspicious content and follow the instructions provided by IT or security. They should avoid deleting messages, clearing browser history, or attempting their own cleanup unless instructed to do so. Those actions can remove evidence that investigators may need. 

Depending on the organization’s reporting procedures, the employee may also need to notify their manager. Managers can help coordinate immediate business needs, but notifying a manager should never delay reporting directly to IT or security. 

What Happens Inside the Organization?

This is where preparation pays off. Before an incident ever occurs, the organization should have established procedures, assigned responsibilities, and trained the people who receive initial reports. Help desk and systems staff need to know how to recognize a potential security incident, collect the necessary initial information, and route it to the right people with the appropriate level of urgency. 

A suspicious email that an employee has not opened may require a different response from a report involving entered credentials or a potentially compromised device. The initial report should help determine the urgency, but the security team should be prepared to reassess as new information emerges. 

A routine IT support ticket may not be the right place for sensitive incident details. Organizations need a restricted incident record that allows authorized personnel to document the investigation, track the response, and protect potentially sensitive information.  

The team should also acknowledge the report so the employee knows it reached the right people and understands what to do next. 

The sooner the team begins investigating, the sooner it can determine what happened and whether it needs to take action to contain the threat.

Investigate What Happened

After the security team triages the initial report, investigators work to establish what happened, when it happened, and whether the activity spread beyond the original employee.

Investigators may contact the employee, examine the affected system, or do both. They’ll ask what the employee saw, whether they clicked a link or opened a file, and whether they entered credentials or approved an unexpected authentication request. They’ll also look for unusual activity that followed. 

The investigation also extends beyond the employee’s recollection. 

Security teams review relevant logs, authentication records, endpoint alerts, email security data, network activity, and other available telemetry. They may conduct threat hunting to identify indicators of compromise or related activity that has not yet triggered an alert. 

Investigators compare the employee’s report with the evidence collected from the organization’s systems. 

Assess the Impact and Look Beyond One Employee

An incident involving one employee can have implications for the wider organization. A malicious email may have reached dozens of inboxes. Stolen credentials may put multiple accounts at risk. Other employees may have opened the same attachment. 

Investigators need to look for similar activity across other employees, accounts, endpoints, and systems. They should determine whether the incident is part of a larger campaign, identify which assets an attacker may have compromised, and assess what access the attacker could have gained.

These findings guide the next steps, including containment, eradication, and recovery. Depending on the situation, that could mean disabling a compromised account, revoking active sessions, isolating a device, blocking malicious infrastructure, removing harmful messages from other inboxes, or resetting credentials. 

The response should follow the evidence. Acting too slowly can allow an incident to spread, while acting without understanding the situation can disrupt business operations or destroy useful evidence.

A Report Is the Beginning of the Response

An employee’s report gives the organization a chance to act, but the response depends on having the right procedures and people in place. That requires clear procedures, coordination between IT and security teams, and the ability to act as new evidence comes in. 

A strong incident response process also depends on employees who feel comfortable speaking up. If they worry about being blamed for a mistake, they may hesitate when time matters most. 

This Cybersecurity Awareness Month, remind employees that they do not need proof of an incident before reporting something suspicious. They should not have to investigate it themselves, and the organization should never criticize them for reporting something that turns out to be a false alarm.

If an employee reports something that turns out to be harmless, thank them for speaking up. How the organization responds to that report will influence whether the employee reports the next one.