Prove You're Covered: Cyber Incident Response Plan

Four weeks of proving senders, requests and sources, and the habit still won't hold every time. Everybody gets caught eventually, including people who work in security. This final week is about what happens in the ten minutes after that, because that's what actually determines the damage.

The difference between a bad ten minutes and a bad six months is reporting speed, not the mistake itself. Attackers count on embarrassment buying them a few extra hours before anyone tells anyone, and those hours are worth more to them than the original click. That's why, across this campaign and in how we advise clients to measure it, report rate and time-to-report matter more than click rate. The behaviour worth encouraging isn't avoiding every mistake; it's surfacing it immediately, and thanking people for checking even when the message turns out to be genuine, since that's the habit working exactly as intended.

So if you clicked a link, entered a password, paid an invoice, or sent something you shouldn't have this month or any other: report it straight away, not after you've assessed how bad it is and not after the weekend. Nobody should be in trouble for reporting. And if it happened to you, assume the same message is being tried on colleagues right now, your report is what protects them. This is why your company has a cyber incident response plan.

Read more on our site: A Guide to Strengthening Your Organisation's Security Culture and Free Cyber Security & Compliance Readiness Assessments.

Talk to us: if you don't yet have a tested incident response process — or you're not sure your reporting route actually works under pressure — our Operational Resilience work covers exactly this under DORA/NIS2.

Get the guide: that's Cyber Awareness Month 2026 done. If you want the full “Prove It” pack, all five weeks, ready-made comms and CybSafe mapping, it's free to download. Get the CAM26 guide.