This is the correct policy. Many IT security incidents happen because someone’s afraid of raising the alarm. If an employee opens a phishing attachment or some

This is the correct policy. Many IT security incidents happen because someone’s afraid of raising the alarm. If an employee opens a phishing attachment or something, they should be able to report it without fear of losing their job so the incident can be contained. Instead - they are incentivised to say nothing and hope for the best for fear of getting fired.