Blame Culture Is a Security Vulnerability

by | Nov 1, 2026 | Blog, Latest News | 0 comments

At 4.45pm on a Friday, a finance assistant clicks a link in an email from a supplier. The page asks for her login. She types her password, then notices the web address looks wrong. Now she has a choice. She calls the security team and faces whatever comes next, or she closes the tab and hopes nothing happens.

Her decision depends less on her training and more on what happened to the last person who owned up.

Silence Is the Real Risk

Verizon’s 2026 Data Breach Investigations Report found the human element in 62% of breaches. Most security teams read this figure as a case for more training. I read it as a case for faster reporting. People will always click. The damage depends on how long the click stays hidden.

Blame stretches that window. A Kaspersky Lab survey of 5,000 businesses found employees had hidden security incidents in 40% of organisations, out of fear of punishment. The research dates from 2017, and I’d welcome newer global data. A separate survey of 1,000 office workers in Ireland, run by Censuswide for IT.ie and SonicWall, found 73% believed their employer holds staff personally responsible for cyber incidents. More than a third admitted they had not reported a breach in the previous 12 months. Embarrassment topped the list of reasons, followed by fear of repercussions.

Every one of those unreported clicks gave an attacker extra hours or days inside a network.

How Blame Shows Up at Work

Blame rarely arrives as a written policy. You see it in smaller habits:

  • A phishing simulation league table naming the worst departments
  • A “gotcha” email from IT after someone fails a test
  • A disciplinary letter after a first honest mistake
  • A senior leader joking in a meeting about whoever let the hackers in
  • A sigh from the security team when a colleague asks a basic question

Each one teaches the same lesson. Keep quiet and keep your head down.

The pattern runs inside security teams too. Analysts who miss an alert, engineers who push a misconfiguration and junior staff with questions all learn fast whether honesty is safe. I founded Cyber Kindness because I saw too much bullying, abuse and toxic behaviour in our industry. Toxic behaviour costs people their confidence and their careers. For organisations, the cost is lost early warnings.

Kindness Is a Security Control

Some security leaders hear the word kindness and switch off. I’d argue kindness belongs in your control framework. A team where people report mistakes within minutes detects problems faster than most tools you buy. Kindness in this sense means a set of behaviours you design, measure and enforce. Here are 5 changes you make this quarter.

  1. Thank the reporter first. When someone reports a click, the first words they hear should be thank you. Fix the problem second. People remember how the first conversation felt.
  2. Separate error from misconduct. Write the difference down and share it. Honest mistakes lead to support and learning. Deliberate breaches of policy, or repeated negligence after support, lead to formal processes.
  3. Measure reporting, not failure. Track how many people report suspicious messages and how fast. Retire league tables of click rates.
  4. Run blameless post-incident reviews. Ask what in the process, tooling or workload made the mistake easy to make. Aviation and healthcare use this approach to learn from near misses, and security teams should too.
  5. Model honesty from the top. Ask your CISO or chief executive to share one of their own near misses at an all-staff meeting. People notice when leaders admit mistakes, and they follow.

Blame-Free Does Not Mean Consequence-Free

Some leaders worry this approach lets people off the hook. The opposite holds true. Someone who ignores policy after training and support still faces consequences. What changes is timing and focus. You contain the incident first and judge behaviour later, and you judge intent instead of outcome. A person who clicked and reported within 2 minutes did the right thing, even though they clicked.

Why AI Raises the Stakes

AI-generated phishing removes the clumsy spelling, and the odd phrasing staff were taught to spot. Cloned voices on phone calls and fake messages on collaboration tools add more routes in. As attacks get harder to recognise, more of your people will get caught out. Your defence then rests on how quickly they tell you. In a culture of fear, a better phishing email turns into a longer breach.

Back to Friday Afternoon

Go back to the finance assistant at 4.45pm. Your security programme succeeds or fails in the next 5 minutes, and the deciding factor is how safe she feels picking up the phone. Build a workplace where people tell you fast and thank them when they do. Kindness is how you get there.

 

Sources