<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-incident-reporting-culture
description: >-
  Build an incident reporting culture that encourages timely disclosure of
  security events, near-misses, and policy violations through blame-free
  reporting channels, gamification, and leadership reinforcement.
domain: cybersecurity
subdomain: security-awareness
tags:
  - incident-reporting
  - security-culture
  - blame-free
  - gamification
  - near-miss
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Incident Reporting Culture

## Overview

A healthy incident reporting culture is the foundation of effective security
operations. This skill covers designing blame-free reporting mechanisms, training
employees on what constitutes a reportable event, reducing friction in reporting
workflows, using gamification to incentivize participation, and measuring culture
health through reporting metrics.

## Prerequisites

| Requirement | Install |
|---|---|
| Ticketing system | ServiceNow, Jira, or PagerDuty |
| Communication | Slack/Teams integration for rapid reporting |
| Framework | NIST SP 800-61, ISO 27035 |

## Commands

| Command | Description |
|---|---|
| `node agent.js design-channel --platforms slack,email,portal --sla 15min` | Design multi-channel incident reporting system |
| `node agent.js train-recognition --scenarios phishing,data-leak,suspicious-access` | Build event recognition training scenarios |
| `node agent.js gamify --rewards points,badges --leaderboard team` | Design gamification layer for reporting program |
| `node agent.js measure --metrics report-rate,mean-time-to-report,false-positive-rate` | Measure incident reporting culture health |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js design-channel --platforms slack,email,portal --sla 15min
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js train-recognition --scenarios phishing,data-leak,suspicious-access
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js gamify --rewards points,badges --leaderboard team
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js measure --metrics report-rate,mean-time-to-report,false-positive-rate
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
