UK businesses are grappling with a significant yet overlooked cyber risk that is frustrating cybersecurity professionals: employees choosing not to report cyber attacks.

A substantial portion of office workers (39%) admitted they wouldn’t inform their cybersecurity team if they suspected they had been targeted in a cyber attack – and this isn’t due to ignorance about security issues.

A survey conducted by data security and management company Cohesity, which included 4,500 workers across EMEA, revealed that UK employees have a better understanding of cyber threats like ransomware than those in France and Germany.

In fact, 43% of UK workers can clearly define what ransomware is, compared to only 28% in France and 30% in Germany. Additionally, 79% expressed confidence in their ability to detect a malicious cyber attack.

"Remaining silent when they suspect a cyber attack is arguably the worst possible reaction from an employee, especially considering they claim to understand the risks involved," said Olivier Savornin, GVP Europe at Cohesity.

"This unwillingness to speak up leaves companies unaware and exposed to potentially severe consequences."

So what's behind this silence? The survey showed that 17% of employees wouldn't want others to think it was their fault, while another 17% feared facing repercussions. One out of every eight workers worried about making a big deal out of nothing.

This tendency to stay quiet is alarming enough that 11% said they would attempt to resolve the issue on their own instead of turning to company experts for help.

Drop the blame culture, build trust

Savornin emphasized that these findings highlight the urgent need for cultural change within organizations to support employees and improve overall transparency.

"We must foster a work environment where individuals feel safe to raise concerns and are properly educated on identifying cyber threats and taking appropriate action — regardless of how minor the issue may appear," Savornin explained.

Earlier this year, a survey by managed services provider IT.ie found that 43% of office workers felt they were likely to cause a cybersecurity incident within the next year.

Of these, 60% attributed the risk to insufficient or absent cybersecurity training, and 31% pointed to poor communication from leadership regarding cyber threats.

This is far from the first time that hesitation around reporting incidents has been observed. For instance, Arctic Wolf’s 2024 Human Risk Behavior Snapshot report from October last year found that one-quarter of workers were too afraid to report security issues.

Interestingly, there may be justification for this fear. A report released last year by Egress revealed that slightly more than half of employees who fell victim to phishing scams faced disciplinary measures.

Notably, 40% of those individuals were terminated after the incident, which only deepens the long-term reluctance to report such events.

In some cases, employees are even instructed not to talk about breaches. A 2023 study by Bitdefender uncovered a growing trend of concealment in enterprise environments.

The survey of 400 IT and security professionals found that nearly half had been directed by senior executives to hide data breaches from stakeholders.

Meanwhile, 30% admitted to deliberately withholding breach information despite having formal disclosure procedures in place.

Stay updated with the latest news, analysis, and reviews by following php.cn on Google News

The above is the detailed content of ‘The worst thing an employee could do’: Workers are covering up cyber attacks for fear of reprisal – here’s why that’s a huge problem. For more information, please follow other related articles on the PHP Chinese website!