Why leadership hears about incidents last
When reporting an incident gets punished, the organization doesn't get safer. It just gets quieter.
In a company where the first reaction to an incident is a hunt for the culprit, people learn the lesson fast: better to fix it quietly and say nothing. That's how you lose the hours in which an attack could have been stopped cheaply.
Leadership has a role here that no technology can replace: saying publicly that fast reporting is valued — even when it's a false alarm, even when the mistake belongs to the person reporting it.
An employee who calls two minutes after clicking the wrong link is worth more than an expensive detection tool that's only half configured.