What should employees do after they notice suspicious activity or a possible incident?

What employees should do first when something looks wrong

The first priority is to stop interacting with the suspicious item and preserve the situation as you found it. That means not clicking, opening, forwarding, replying, reinstalling, deleting, or attempting to “test” the message or system. A fast, clean report gives responders the best chance to verify what happened and limit spread before evidence is lost.

If the activity involves email, chat, a browser prompt, a device alert, or an unusual login request, the same rule applies: report it through the approved channel immediately rather than trying to diagnose it yourself. The report should be specific enough to let the security team reconstruct the event, including what you observed, when it happened, and which account, device, or application was involved.

How to report suspicious activity without making the situation worse

The most useful report is factual, short, and complete. Include the sender or source, the subject line or message content, the time you noticed it, any error text, and whether you took any action before realising it was suspicious. If you can safely do so, preserve screenshots, headers, file names, URLs, or other visible details, but do not collect evidence in a way that expands the incident.

Employees should use the organisation’s approved process, whether that is email, a ticketing system, a hotline, or a dedicated report button. Consistency matters because it routes the event to the right team, creates a traceable record, and helps the organisation spot repeat patterns across multiple reports. For incident handling discipline, a structured workflow such as the Post-Incident Review and Root Cause Analysis Template is a useful reminder that good reporting starts with good evidence capture.

What good response looks like after the report is sent

Once the report is filed, the employee’s job is to let the security or IT team take over. That may mean disconnecting a device from the network if instructed, resetting a password only when told to do so, or avoiding further use of an account until it is checked. The key judgment is that containment comes before curiosity, because continued interaction can overwrite logs, trigger additional actions, or give an attacker more time.

Organisations that handle incidents well also make it easy for staff to escalate quickly and for responders to link a report to broader events. In regulated environments, clear incident reporting expectations are part of a wider operational discipline, as reflected in OSFI Guideline B-13 Guide, while broader response playbooks often align with the reporting and coordination practices used by FIRST.

Risk and Threat Considerations

Suspicious activity is often the earliest visible sign of phishing, account abuse, malware, or an active intrusion. The risk is not just the message or alert itself, but the chance that a small foothold turns into credential theft, lateral movement, or data exposure if the employee keeps engaging with it.

Failure mechanism: The employee continues interacting with the suspicious item, which can confirm a live account, trigger malicious links or attachments, or destroy evidence that investigators need to trace the incident.

Impact: Delayed reporting increases containment time, raises the chance of compromise spreading, and can make it harder to determine scope, root cause, and whether other users were targeted.

Practitioner Guidance

What to verify: Make sure employees know the exact reporting path for email, chat, device alerts, and suspected account compromise. The process should work from both managed and remote devices, because hesitation at the first moment often determines whether a report arrives in time to matter.

What to measure: Track time from first observation to report submission, plus the quality of the report itself. Good reporting includes enough detail for triage without requiring the employee to investigate the event independently.

Common mistake: Treating “report it if you are sure” as the standard. In practice, staff should report uncertainty early, because the security team can dismiss a false alarm more safely than it can recover evidence that was deleted or altered.

Practitioner takeaway: The right employee behaviour is not to solve the incident, but to preserve it long enough for responders to verify, contain, and act on it.

Related resources from NHI Mgmt Group

• What should incident response teams do when they see possible remote access, exfiltration, and authentication-bypass activity at the same time?
• What should users do after they notice a look-alike domain or suspicious URL?
• What should employees do after they click a suspicious link or open a phishing attachment?
• What should organisations do after they detect suspicious privileged account activity?