Organizations build a speak-up culture for cybersecurity by making it safe, practical, and expected for employees to question unusual requests, report concerns, challenge apparent authority, and escalate potential security or fraud risks. This requires visible leadership support, clear reporting and escalation procedures, realistic practice, constructive responses to mistakes, and measurement of whether employees actually speak up when it matters.
A speak-up culture is particularly important for preventing impersonation fraud, business email compromise, insider risk, and failures of security controls that depend on human judgment. Employees may recognize a potential problem and still remain silent because they are uncertain, concerned about consequences, reluctant to challenge a senior colleague, or worried about delaying important work. Those decisions are influenced by organizational culture as much as individual security knowledge.
For CISOs and risk leaders, the challenge is understanding whether the organization has created conditions in which people can act on their concerns. A policy encouraging employees to report suspicious activity is useful, but it tells us very little about whether someone will question an apparent CEO who wants an urgent payment or challenge a manager who asks them to bypass a security procedure.
A speak-up culture is an organizational environment in which employees feel able and expected to raise concerns, ask questions, challenge questionable instructions, report mistakes, and escalate uncertainty without unreasonable fear of embarrassment, retaliation, or negative professional consequences.
In cybersecurity, this includes reporting suspicious communications, questioning unusual requests, disclosing potential incidents, challenging unsafe practices, and asking for clarification when a security requirement is unclear. It also includes situations where an employee needs to delay or refuse an action until appropriate verification or authorization has been completed.
The concept is closely related to psychological safety, which concerns whether people believe they can take interpersonal risks within a team. Research by Amy Edmondson and others has shown how psychological safety influences learning behavior, communication, and willingness to raise concerns in organizational settings. Amy Edmondson's research on psychological safety
In security, the practical question is whether employees believe they can do the right thing when doing so may inconvenience someone, interrupt a workflow, or expose a mistake.
Many cyber fraud scenarios depend on the victim accepting an instruction that appears to come from someone with legitimate authority.
An accounts-payable employee receives an urgent request from the CFO. A help-desk analyst is contacted by someone claiming to be a senior executive. A procurement employee receives a banking change from a familiar supplier. A customer-service representative is pressured to disclose information because the caller insists that the matter is urgent.
In each situation, the employee may have a reasonable basis for questioning the request. The challenge is whether they feel permitted to act on that uncertainty.
Attackers deliberately exploit urgency, authority, familiarity, and social expectations. A convincing impersonation attempt may succeed because the employee does not want to challenge someone important, disappoint a customer, or appear unhelpful.
The defensive value of speaking up becomes clearer when we examine the actual business process. A finance employee who pauses an unusual payment and requests independent verification may prevent a significant loss. A help-desk analyst who refuses to bypass identity-proofing requirements may prevent account takeover. A colleague who reports a suspicious request may help security identify a wider campaign.
Our guide to verification behavior in cybersecurity explains how recognizing a verification requirement, selecting the correct method, and escalating uncertainty can be measured as distinct security behaviors.
A speak-up culture helps make those behaviors possible.
Employees may hesitate to speak up for reasons that have little to do with their knowledge of cybersecurity.
Some fear making a mistake or being embarrassed in front of colleagues. Others worry that reporting an incident will result in blame, disciplinary action, or damage to their reputation. Employees may also be reluctant to question senior leaders, challenge customers, or interrupt business activities that others consider urgent.
Uncertainty is another important factor. Someone may notice something unusual but feel they lack enough evidence to justify raising a concern. If previous reports have been dismissed, ignored, or treated as an inconvenience, that employee may be even less likely to speak up the next time.
The organization's formal policies can therefore tell a very different story from its everyday practices.
A company may encourage employees to report suspicious activity while managers criticize people for delaying transactions. It may promote a no-blame culture while publicly identifying employees who fail phishing simulations. It may ask people to challenge authority while senior leaders routinely insist that security procedures do not apply to them.
Employees learn from those experiences.
The question for security leaders is whether the organization's incentives, leadership behavior, and operational practices reinforce the conduct they want employees to demonstrate.
Authority can be a powerful influence on human decision-making, particularly in hierarchical organizations or situations where an employee believes a request comes from someone with greater responsibility or status.
An executive request may feel more urgent than an ordinary instruction. A senior manager may appear to have the authority to override a procedure. An employee may assume that questioning a leader's decision would be inappropriate, even when the request conflicts with established security controls.
Attackers exploit these assumptions through executive impersonation, fraudulent payment requests, account recovery scams, and other forms of social engineering.
The problem becomes more complicated when legitimate leaders regularly make exceptions to normal procedures. Employees may struggle to distinguish between an authorized exception and a fraudulent request because the organization has established a pattern in which apparent authority overrides the documented process.
That is why leadership behavior matters so much.
A CEO who supports verification when their own request is delayed sends a stronger message than a hundred posters encouraging employees to report suspicious emails. A manager who thanks an employee for raising a concern helps establish that security procedures are part of responsible work.
Organizations should make clear that authority does not eliminate verification requirements. Seniority may determine who can authorize an action, but it should not allow someone to bypass controls designed to establish whether the instruction is legitimate.
Psychological safety influences whether people feel comfortable acknowledging uncertainty, admitting mistakes, questioning assumptions, and raising concerns.
In cybersecurity, those behaviors can be essential to preventing incidents and limiting their consequences. An employee who accidentally shares information with the wrong recipient may report the mistake immediately if they expect a constructive response. Someone who suspects a fraudulent payment request may seek clarification before acting if they believe their concerns will be taken seriously.
An organization that responds to every error with blame may discourage the very reporting behavior it needs.
This does not mean that accountability disappears. Employees remain responsible for following policies and performing their duties. The distinction is between holding people accountable for their actions and creating an environment where admitting uncertainty or reporting a mistake is treated as a professional failure.
Security leaders should also recognize that psychological safety is not necessarily uniform across an organization. Teams, business functions, locations, leadership styles, and working environments can create very different experiences.
A global organization may have strong reporting norms in one function and substantial reluctance to challenge authority in another. Treating the workforce as a single cultural population can obscure those differences.
Our broader work on trust and human cyber risk explores how beliefs about authority, credibility, and organizational expectations influence security decisions.
Leadership support needs to be visible in the decisions people make and the responses they receive.
Executives should communicate that employees are expected to verify unusual requests, including those appearing to come from senior leadership. Managers should reinforce that completing required checks is part of good performance, even when those checks introduce delays.
Organizations can also make the desired behavior more concrete by establishing clear expectations for high-risk activities. A finance employee should know that independently verifying a banking change is required, regardless of who requests it. A help-desk analyst should know that an executive's urgency does not eliminate identity-proofing requirements.
When employees raise concerns, the response matters.
A manager who thanks someone for challenging an unusual instruction reinforces the behavior. A security team that acknowledges a report and explains what happened helps employees see that reporting has value. An organization that uses incident reviews to improve processes demonstrates that speaking up can lead to meaningful change.
These actions create credibility over time.
Employees are unlikely to believe that speaking up is encouraged simply because a leadership presentation says so. They need to experience the expectation in ordinary work.
A speak-up culture needs practical mechanisms for raising concerns and obtaining help.
Employees should know where to report suspicious communications, how to escalate potentially fraudulent requests, and what to do when an action cannot be safely completed. Those procedures should be accessible, understandable, and appropriate for different working environments.
An office employee may use a reporting button or internal messaging channel. A factory worker may need a supervisor, telephone number, or local escalation contact. A field technician may operate with limited connectivity and require a different procedure.
The reporting mechanism should match the risk and urgency of the situation.
A suspicious email that has not been acted upon may be handled through a standard reporting workflow. A potentially fraudulent payment scheduled for immediate release may require direct contact with finance leadership, fraud prevention, or the security operations team.
Employees should also understand what happens after they report a concern. Acknowledgment, appropriate feedback, and visible follow-through can help build confidence that the organization takes reports seriously.
Reporting procedures should be tested just like other security controls. If employees cannot identify the correct escalation path during a realistic scenario, the organization has an operational weakness that additional encouragement alone will not solve.
Training should help employees practice the situations in which speaking up is socially difficult or operationally inconvenient.
Generic messages encouraging employees to report suspicious activity are unlikely to prepare someone for a realistic conflict between a security requirement and an apparently urgent business instruction.
Role-based scenarios provide a better opportunity.
A finance employee might practice challenging an executive payment request. A help-desk analyst might rehearse refusing an unauthorized MFA reset. A procurement employee might work through a supplier banking change where the usual contact cannot be reached. A manager supervising an AI-enabled process might need to question an automated recommendation before approving a consequential action.
The learning should address both the technical or procedural requirement and the interpersonal challenge.
Employees may need to practice how to explain a verification requirement respectfully, how to delay an action without escalating conflict, and how to involve the appropriate authority when a requester refuses to cooperate.
Cybermaniacs approaches these issues through contextual learning, behavioral development, and organizational culture. Our Cyber Learning Experience supports ongoing learning, while Cybersecurity Content as a Service helps organizations reinforce expectations through targeted campaigns and communications.
The aim is to make the desired behavior familiar enough that employees can use it when the situation becomes uncomfortable.
Speak-up culture should be measured using multiple sources of evidence rather than a single survey question or reporting statistic.
Surveys can help assess whether employees believe they can challenge authority, report mistakes, ask questions, and escalate concerns without negative consequences. Scenario-based assessments can explore whether employees recognize situations that require escalation and whether they know how to respond.
Operational evidence can provide another perspective.
Organizations may examine reporting patterns, escalation behavior, the timeliness of incident reporting, responses to simulated scenarios, and the way managers handle concerns. Interviews and facilitated discussions can help explain differences across teams or business functions.
Each measure has limitations.
A high number of security reports may indicate strong engagement, but it may also reflect an increase in suspicious activity. A low reporting volume may indicate few incidents, weak detection, lack of confidence, or poor awareness of reporting channels.
Similarly, an employee who says they feel comfortable challenging authority may behave differently when confronted with an urgent request from an actual senior leader.
Measurement needs to connect stated beliefs, observed behavior, and organizational context.
Potential indicators include employees hesitating to report mistakes, uncertainty about escalation procedures, reluctance to challenge senior leaders, frequent informal exceptions, and inconsistent responses from managers when concerns are raised.
Organizations may also observe delays between suspicious activity and reporting, low confidence in reporting mechanisms, or significant differences between teams in willingness to escalate.
These indicators should prompt investigation rather than automatic conclusions.
A team with few reports may be operating in a relatively low-exposure environment. Another may have substantial reporting activity because employees encounter more suspicious communications. Differences in workload, technology, leadership, and business processes can influence the evidence.
This is why Cybermaniacs emphasizes the importance of an appropriate measurement model. In The Best Human Risk Measurement Tool Is Useless If the Measurement Model Is Wrong, we examine why organizations need to understand what a measure represents before using it to make risk decisions.
A speak-up culture assessment should identify meaningful organizational conditions and help leaders determine what needs to change.
Verification controls often depend on employees being willing to interrupt a process.
A payment may need to be delayed while supplier information is confirmed. An account reset may need to be refused until identity is established. A suspicious executive instruction may need to be challenged before a transaction proceeds.
Those actions can create interpersonal friction, particularly when the requester appears important, familiar, or frustrated.
An organization may have technically sound verification procedures and still experience failures because employees feel uncomfortable applying them.
This is why culture and control design need to be evaluated together.
Our guide to designing verification processes to prevent impersonation fraud explains how organizations can establish independent verification methods, authorization rules, and escalation paths. Speak-up culture helps determine whether employees will use those mechanisms under real operating conditions.
The two are mutually reinforcing. Clear procedures make it easier for employees to challenge unusual requests, while supportive leadership makes it more likely that those procedures will be followed.
Organizations should respond promptly, constructively, and proportionately when employees report security mistakes or near misses.
The immediate priority is to understand the potential impact, contain any exposure, and preserve relevant information. Employees should know what assistance is available and what actions they need to take next.
After the immediate issue is addressed, the organization should examine the contributing conditions.
Was the employee unclear about the procedure? Did the technology create unnecessary confusion? Was the person working under unusual pressure? Did the organization establish incentives that encouraged a shortcut? Were reporting instructions accessible and understandable?
A useful incident review identifies improvements that can reduce the likelihood or consequences of similar events.
Accountability remains important, particularly where deliberate misconduct or repeated disregard of established requirements is involved. However, organizations should avoid creating a general expectation that reporting an error will automatically lead to punishment.
If employees believe the safest career decision is to conceal a mistake, the organization may discover incidents much later than it otherwise would.
As organizations adopt AI systems and autonomous agents, employees increasingly need to question outputs, challenge recommendations, identify unexpected behavior, and intervene when automated actions create uncertainty or risk.
These responsibilities depend on more than technical literacy.
An employee may recognize that an AI-generated recommendation appears incorrect but hesitate to challenge it because the system is considered authoritative, the organization is promoting rapid adoption, or colleagues routinely accept its outputs without question.
A manager supervising an automated workflow may face similar pressures. If the system is expected to improve efficiency, stopping it to investigate an anomaly may feel like failing to deliver the promised benefits.
Organizations need to make it clear when people are expected to question AI-generated information, verify important claims, escalate unexpected behavior, and intervene in automated processes.
That requires appropriate governance, clear decision rights, meaningful oversight procedures, and an organizational culture that supports human judgment.
Cybermaniacs is extending its work in Human Risk Management into AI enablement and agentic risk through AIECM (AI Enablement & Culture Management) and ARC (Agent Risk & Control). These areas address the competencies, behaviors, cultural conditions, and control responsibilities that emerge as people work with and supervise AI systems.
A speak-up culture becomes particularly valuable when employees are expected to challenge decisions made or recommended by systems that may appear highly capable or authoritative.
Improvement begins with understanding the current conditions.
Organizations should assess whether employees know how to report concerns, whether they feel comfortable challenging instructions, how managers respond to uncertainty, and whether reporting mechanisms work in practice.
The findings should be examined across relevant business functions and populations. A finance team, help desk, manufacturing site, and corporate leadership group may experience different pressures and expectations.
Interventions should then address the conditions identified.
Some organizations may need clearer escalation procedures. Others may benefit from leadership development, manager coaching, role-based scenarios, more accessible reporting channels, or changes to processes that make secure behavior unnecessarily difficult.
Progress should be evaluated through repeated assessment and operational evidence.
Cybermaniacs supports this work through Human Risk Assessments and Baselines, cultural measurement, targeted learning, engagement campaigns, and Human Risk Management advisory services. The aim is to understand the underlying conditions that influence security behavior and develop interventions that make the organization more resilient.
A strong speak-up culture develops through consistent experience. Employees need to see that raising concerns is expected, that managers respond constructively, and that the organization acts on what it learns.
Most employees can agree that reporting suspicious activity is important. The more revealing question is what happens when raising a concern delays a payment, challenges a senior executive, interrupts a customer interaction, or exposes a mistake.
Those are the moments when organizational culture becomes visible.
If employees have clear procedures, supportive leadership, and confidence that their concerns will be taken seriously, they are better positioned to act. If they expect blame, embarrassment, or pressure to proceed, even well-designed security controls may fail.
For security and risk leaders, speak-up culture deserves attention because it influences whether employees perform some of the most important human controls in the organization.
Building that culture requires more than awareness. It requires leadership behavior, practical procedures, realistic learning, meaningful measurement, and a willingness to examine how the organization actually responds when someone raises a concern.
A speak-up culture is an organizational environment where employees feel able and expected to report concerns, question unusual instructions, challenge apparent authority, and escalate potential security risks without unreasonable fear of negative consequences. It supports behaviors such as incident reporting, independent verification, and responsible escalation.
Psychological safety influences whether employees feel comfortable admitting mistakes, asking questions, reporting suspicious activity, and challenging potentially unsafe instructions. These behaviors can help organizations detect incidents earlier, prevent fraud, and improve security controls.
Organizations can encourage reporting through visible leadership support, accessible reporting channels, clear escalation procedures, constructive responses to mistakes, and realistic training. Employees should understand what to report, how to report it, and what happens after a concern is raised.
Organizations can assess speak-up culture using surveys, realistic scenarios, reporting and escalation data, interviews, and evidence of how managers respond to concerns. Findings should be interpreted in context because reporting volume alone does not establish whether employees feel safe or whether the culture is effective.
Speak-up culture makes employees more willing to challenge unusual payment requests, independently verify supplier changes, question apparent executive instructions, and escalate uncertainty. These behaviors support the financial and operational controls that help prevent business email compromise and impersonation fraud.
Speak-up culture supports AI governance by encouraging employees to question AI-generated outputs, report unexpected behavior, challenge inappropriate automation, and intervene when human oversight is required. It helps ensure that people can exercise meaningful judgment and accountability within AI-enabled workflows.