How to report a suspected security incident at work

Reporting fast and early is what limits damage. You won’t be in trouble for raising a false alarm — the opposite.

1. Report the moment you’re suspicious — a clicked link, an odd email, a strange prompt — don’t wait to be sure.
2. Note what happened, when, and how it arrived, while it’s fresh.
3. Contact your IT team or provider through your agreed channel — phone or ticket, not by replying to the suspect email.
4. Don’t forward a suspicious email to colleagues ’to warn them’ — it spreads the risk; tell IT instead.
5. Keep the device on but disconnected from the network unless told otherwise.
6. Follow up to confirm it was received — silence is not confirmation.