8:58 AM

This is a speak-up decision while wearing security clothing. The psychology that suppresses the report — embarrassment, the scorecard, “I’ll handle it myself,” “I’ll report it when it won’t cost me” — is the same psychology every reporting program contends with. That is why it belongs to the compliance conversation, not just the security one.

1 · The dilemma  ·  ~2 min

The team hears the situation in the employee’s own voice, as audio or read aloud. The manager asks one question: in your own words, what situation is she in?

2 · First, just react  ·  ~3 min

What makes this feel like something she can handle herself — and what gives you pause? At least one of each before moving on. Nothing is resolved here.

3 · Three choices — the one that matters  ·  ~3 min

Everyone commits independently, before any discussion and before any reveal. Then one voice per option: what made that choice feel reasonable?

4 · The right call  ·  ~2 min

The answer, the reasoning behind the two wrong turns, and a message that arrives at 9:12 showing what those turns actually purchased.

5 · Why it’s harder than it looks  ·  ~2 min

Three sentences someone in the room was thinking during the vote, each answered in the employee’s own voice rather than as an error.

6 · Apply it here  ·  ~3 min — end here, every time

Who do you call, right now, from this chair — and what actually happens to your laptop when you do? Answered from the two fill-ins the sponsor supplied before the session.

A — Fix it at the source

Change the password, run the self-service scan, watch the account. Four minutes, no ticket, no queue.

B — Report it now, at eighty percent sure

Use the official channel immediately and follow the instructions that come back.

C — Verify first, then escalate with facts

Call the supplier, ask a technical colleague to glance at the header. Report with facts instead of a feeling.

All three are written to be defensible, and each is somebody’s honest professional instinct. The manager’s job is to keep each one alive long enough to be felt before the answer arrives.

She isn’t deciding whether it was a phishing attempt. She’s deciding who gets the next twenty minutes — her or the security team.

Vote last and speak last, every time. If the manager signals early, the independent commitment collapses into agreeing with the boss, and the session measures nothing.

No scoring, no roster, no participant-level record. Aggregate totals only. If anyone asks whether this affects their standing, the answer is no — said plainly. A session in which a metric suppresses a report cannot itself be scored.

If someone starts describing a real, unreported incident, stop. The discussion pauses, the matter is immediately taken offline, and it is routed through the organization’s official reporting channel the same day. Real incidents are never processed in the room.

One line the manager says personally

The guide scripts a first-person line about the manager’s own dashboard—that the goal is not to catch anyone, and that if a metric makes someone hesitate for even five minutes, the metric is the problem.

It is the one moment where paraphrasing is at risk. Said as written, it sounds like the manager. Reworded, it sounds like the organization — and then it lands as policy, which is not what it is.

The aggregate vote split, recorded before the reveal, shows which reasonable choices actually competed in your room.

The reasoning behind the wrong turns — in the room’s own words, not inferred afterward.

Whether anyone can name the reporting action in thirty seconds without guessing.

Whether your guidance answers the after-the-report questions — what happens to your access, who follows up, what to do at eighty percent sure — or only says “report promptly.”

Even a unanimous room produces a finding

A near-unanimous vote for the right answer is common and not a failure—it simply means the vote produced no split. The guide converts it into the harder question on the spot: good, that’s the right instinct — so do it right now. What exactly do you press or dial from this chair? Knowing how to report is easy. Naming the channel is not.

A six-slide deck, with the situation as audio or a read-aloud script.

A manager’s facilitator guide with every answer a manager needs, timings per slide, and scripted language for the moments that matter.

An “if they ask” sheet — the five questions rooms actually raise, with short answers that stay accurate across systems.

Voting instructions for in-person, virtual, and hybrid rooms — including how to run a simultaneous vote so later voters aren’t influenced.

An Insights capture sheet for program-level findings — no names, no personal disclosures, no case details.

An invitation and rules sheet for participants, sent before the session.

The no-blame framing. Reconcile “the click itself is treated as no-fault” with your actual policy. If yours differs, the wording changes before the session — it is never softened quietly in the room.

The containment reality. What genuinely happens to a reporter’s access and laptop?

The official reporting action. The exact thing a person presses or dials.

Two of those become fill-in lines the manager reads at the close. If the honest answer to the containment question is “we don’t know,” that goes back to the sponsor before the session runs — because it is a finding in itself, and because the closing question only works if the room’s fear is met with the real answer.

Where this sits

8:58 AM is an Xcelus Decision Brief™ — the fifteen-minute, manager-led tier. The underlying scenario is also available on its own for reinforcement between sessions.

One level up, the same instinct appears as a leadership problem: whether a known risk reaches the people who need it or waits for a cleaner version. That is Keep It Off the Dashboard.