The Guest does his best reading at 2am. Nobody about, lights off, payroll dates and invoice approvals there for the taking. For six years it worked. Then the office changed two things. People started reporting what looked odd, and someone started watching the place at night.
That’s incident reporting in a nutshell. Attackers rarely arrive without leaving a trace. The question is whether anyone reports what they see, and whether anyone is listening when they do.
Attackers keep different hours to you
According to the Sophos Active Adversary Report 2026, 88% of ransomware payloads were deployed outside normal business hours, and 79% of data exfiltration happened off hours too. Attackers know when your office is empty, and they plan around it.
They also move quickly once inside. The same report found a median dwell time of just three days between initial access and detection. Attackers reached Active Directory a median of 3.4 hours after first compromise, which is less time than a long lunch and a couple of meetings.
Put those together and the maths is simple. If a suspicious email clicked on Thursday afternoon isn’t reported until Monday morning, the attacker has had the whole weekend to themselves.
Noise that nobody heard
We see this in real incidents. By the time our security team was called in to help one organisation recover, attackers had been inside its environment for over a month. Looking back, the signs were there. Alerts had fired, clues had been left and the attackers had made plenty of noise. Nobody noticed, because nobody was watching and nobody felt it was their place to raise a flag.
Once we were on the job, we had them partly back online within a week and most systems recovered within a month. But recovery started a month too late, and by then the financial damage had already been done.
That’s not unusual. In Australia, only 50% of organisations hit by ransomware recovered within a week, and 16% took between one and six months. Early reporting is one of the few things that reliably shortens that timeline.
Why people don’t speak up
If early reporting is so valuable, why doesn’t it happen? In our experience, the reasons are almost always cultural rather than technical.
- Fear of blame. If the last person who clicked a bad link was named and shamed, the next one will stay quiet.
- Fear of looking silly. Nobody wants to be the one who raised the alarm over a legitimate invoice.
- Not knowing how. If the process involves finding the right address or form, it won’t get used at 9pm.
- Assuming someone else has. The more people receive a suspicious email, the less likely any one of them is to report it.
- Never hearing back. People who report something and hear nothing stop reporting.
Every one of those is fixable, and none of them needs a big budget.
Building a no-blame reporting culture
The best security cultures treat a report as a win, even when it turns out to be nothing, and especially when someone reports their own mistake. A person who says ‘I think I clicked something I shouldn’t have’ within five minutes has done you a huge favour. Treat them that way. No shame in saying something is the message The Guest least wants your people to hear.
- Make it one click. A report button in Outlook and Teams, available on mobile, is the minimum.
- Say thank you, fast. An automated acknowledgement plus a human follow-up for real threats closes the loop.
- Celebrate self-reporting. Clicking is forgivable. Silence is what causes the damage.
- Run blameless reviews. After an incident, focus on what failed across people, process and technology, not who to blame. Witch hunts rarely uncover the truth.
- Measure time to report. How quickly people raise a flag is one of the most useful security metrics you can track, and one boards and insurers increasingly ask about.
Know your plan before you need it
A report is only the first step. What happens in the next hour depends on whether you have an incident response plan, and whether anyone has actually run it.
A good plan answers the questions nobody wants to work out at 2am on a Sunday:
- Who leads. Who runs the response, who can make the call to isolate systems or take them offline, and who steps in if they can’t be reached.
- Who to call. Your IT team, security provider, insurer, legal advisers and key suppliers, with after-hours numbers kept somewhere other than the systems that might be down.
- What to do first. Clear steps to contain the threat, preserve evidence and keep the business running while you recover.
- Who to tell, and when. Staff, customers, the board and regulators.
Some of those obligations are legal ones. Since 30 May 2025, Australian businesses with an annual turnover above $3 million have been required to report any ransomware or cyber extortion payment to the ASD within 72 hours of making it. Privacy obligations under the Notifiable Data Breaches scheme may apply too.
A plan that sits in a drawer won’t do much. Run it. A tabletop exercise walks leadership through a realistic scenario, such as a ransom note on a Monday morning, and quickly exposes the gaps: the approver who’s on leave, the backup nobody has tested, the phone list saved on the file server that’s now encrypted. Far better to find those on a quiet Tuesday than in the middle of an incident.
Build outside help into your plan too. The ASD received a cybercrime report every six minutes on average in 2024-25, and the average self-reported cost of a cybercrime to a business rose 50% to $80,850. Reporting to ReportCyber gives you access to free incident response advice, 24 hours a day.
Who’s listening at 2am?
A reporting culture needs someone on the other end. In Australia, 45% of organisations hit by ransomware said a lack of people or capacity was a root cause, the most common answer of all. IT teams aren’t failing here. Expecting a small internal team to watch the network through the night and every weekend is simply unrealistic.
Fast reporting only works when all three parts of your security are pulling together:
- People. Staff who feel safe raising a flag, know how to do it in one click, and hear back when they do. ASAP, our managed security awareness program, builds that habit and measures how quickly your people speak up.
- Process. A clear plan for what happens next. Everyone knows who acts on a report, who makes the call to isolate systems, and who handles your reporting obligations, at any hour.
- Technology. Round-the-clock threat detection and response. Our Managed Detection and Response service makes sure an alert at 2am reaches someone who can act on it, not an empty inbox.
Most organisations are strong in one or two of these. A report that lands with no process behind it, or an alert nobody is watching, still leaves the door open. We help you find where the gap is and bring all three up to date, so when someone does raise the alarm, someone is there to answer it.
The Guest’s run ended the day someone reported him. Would your team do the same? The Guest Prevention Program starts with a free staff awareness assessment that shows whether your people know what to report, how to report it and who to tell. How long has your guest been staying?
