When Security Incentives Reward Silence Instead of Early Warning

After every serious incident, someone asks the same question: who knew, and when? The answer is usually uncomfortable. Several people knew something - an engineer saw the odd login pattern, a manager heard the workaround was routine, a team noticed the control everyone skipped. The information existed. It just never traveled upward until it was too late to be useful.

The instinct is to blame culture, as if silence were a personality trait. It is more mechanical than that. People report what they are rewarded for reporting, and they sit on what they are punished for surfacing. If the scorecard celebrates zero incidents, teams stop finding them. If the messenger who raises a concern gets a remediation plan dumped on their desk, the next messenger stays quiet. Cybersecurity incentives decide what risk reporting actually happens - whatever the policy says.

TLDR

• Incident statistics measure reporting behavior as much as they measure security. A spotless record can mean a healthy environment or a frightened one.

• Targets and consequences quietly set the real reporting threshold. "No findings" goals, incident-count bonuses, and blame-heavy postmortems all teach people to look away.

• Early warnings feel expensive to the person raising them and cheap to the organization hearing them. Incentives decide which side of that trade employees land on.

• The test is behavioral, not documentary: how were the last few people who raised a concern actually treated, and what happened to escalation timing after targets were introduced?

• Boards cannot see silence directly. They can ask for the evidence that would reveal it: escalation timing, near-miss rates, and how early warnings were handled.

The scoreboard writes the real policy

Every organization has two risk-reporting policies: the one in the handbook and the one implied by the incentives. The handbook says report early, no blame, escalate anything suspicious. The incentives say something else: the team with the cleanest audit gets praised, the manager whose area logs the most incidents gets scrutiny, and the person who raised last quarter's near miss spent six weeks writing remediation plans.

Employees are excellent readers of the second policy. They learn that a "good" quarter is a quiet one, that ambiguous signals are best resolved locally, and that the safest career move is to fix things quietly or not find them at all. None of this requires bad people. It is what rational people do inside the incentive structure they are given. Cybersecurity incentives produce exactly the risk reporting they pay for.

The three mechanisms that buy silence

The same patterns show up across organizations:

• Finding-count targets. Goals like "zero repeat findings" or "reduce incidents 20%" sound like rigor. In practice they put a price on discovery. The easiest way to hit a finding target is to stop looking, and the data will not tell you that is what happened.

• Messenger economics. When raising a concern means owning the cleanup, the investigation, and the awkward meeting, raising it is personally expensive. People learn to be sure before they speak - and "sure" usually means "after it is obvious," which is another way of saying "late."

• Escalation asymmetry. Reporting up that turns out to be nothing is remembered as a false alarm; staying quiet about something that turns out to be real is shared blame, diffused across everyone who might have noticed. Silence is individually safer than speech. Only deliberate counter-incentives change that math.

What early warning actually looks like

Healthy reporting has a recognizable shape: a steady stream of small, imperfect, early signals - odd access patterns, near misses, controls being worked around, vendors behaving strangely. Most of it resolves to nothing. That is not noise; it is the system working. A pipeline with no small signals is not a clean environment. It is a clogged pipe.

The organizations that catch incidents early treat a well-handled early warning as a success story: named, thanked, and visibly cheap for the person who raised it. They measure time-to-escalation the way they measure time-to-detect, because the two are the same control.

A worked example (fictional)

A financial services firm sets a divisional goal: cut reported security incidents by a quarter. It succeeds. Twelve months later a fraud event surfaces that had been visible for months - a contractor's account touching systems outside its scope. Three employees had noticed. None reported it, and all three gave versions of the same reason: the last person who raised a security concern in that division spent weeks in review meetings, and the division was being measured on keeping incident counts down.

The post-incident review does the honest thing: it treats the incentive structure as a finding, not just the missed signal. The target is reframed - the division is now measured on escalation timing and near-miss reporting quality, with leadership review of how each early warning was handled. Reported incidents tick upward the following quarter, which the board is told to read as progress.

What the board should ask

• What targets and consequences attach to security findings and incident counts, and what behavior do they reward?

• How many near misses and early warnings were raised this quarter - and is a low number treated as good news or as a question?

• How were the last three people who escalated a concern treated, and what happened next for each of them?

• What is the average time from an employee noticing something to it reaching someone who can act - and is that measured at all?

• When targets change, does anyone check what happens to reporting volume afterward?

If management can only answer with policy documents, the board is looking at the written policy, not the operating one.

Frequently asked questions

How do incentives affect cybersecurity risk reporting?

Incentives set the real threshold for what gets reported. Targets that reward low incident or finding counts discourage discovery; consequences that make raising a concern personally costly encourage delay. Employees follow the implied incentives rather than the written escalation policy, so reporting volume and timing track the reward structure, not the rules.

Is a low number of reported incidents a good sign?

Not by itself. A low count can reflect a healthy environment or a culture where people avoid finding and reporting problems. The distinguishing evidence is the flow of small signals: near misses, early warnings, and questions raised. A mature organization expects a steady stream of minor reports and is suspicious of their absence.

What should be measured instead of incident counts?

Escalation timing (how fast a noticed concern reaches someone who can act), near-miss and early-warning volume, the fraction of reports handled without burdening the reporter, and closure rates on what was raised. These measure the reporting system itself rather than punishing what it finds.

What can a board do about incentive-driven silence?

Ask for the behavioral evidence: how recent reporters were treated, what happened to reporting volume after targets changed, and how long escalation takes. Ask management to review compensation and performance goals that attach to finding counts. Boards cannot hear silence, but they can require the measurements that make it visible.

Closing

Every organization gets the risk reporting its incentives pay for. If early warnings are rare, the first place to look is not the workforce's courage but the scoreboard's design. The board that wants to hear bad news early has to make sure someone is rewarded for delivering it.