About this module
Not every technical problem is a security incident, but some quiet signals need fast action. This module helps learners tell the difference between routine issues and warning signs such as ransom notes, unusual login alerts, compromised passwords, clicked phishing links, lost devices, or unexpected access. The lesson keeps the message simple: report early, even before you are certain. Security teams can sort out false alarms. Delayed reports give attackers more time, and that is where small problems become expensive ones.
Key takeaways
Not every glitch is an emergency, and not every quiet system is safe. In the next three minutes, you'll learn to tell the difference, fast. Slow Wi-Fi. A strange pop-up. A frozen screen. Most of it is nothing more than a busy network. But a handful of these moments are the very first sign of a real attack.
A sluggish laptop after an update is routine, nothing to escalate. But if a ransom note appears and your files are suddenly locked, that is a security incident, and it needs to be reported immediately. Forgetting a password and resetting it is normal, everyone does it.
But a login alert from a country you've never visited is not routine, it means someone else may have your credentials. Deleting spam on sight is exactly the right habit, and it ends there. But if you clicked a link and entered your password on a fake page, that credential is compromised, report it now.
On average, it takes over two hundred days to detect a breach, and delays get expensive fast. One in three breaches is first spotted by an employee, not a tool, that employee could be you. Watch for files that vanish or get encrypted, login alerts from strange places, unexplained system changes, or anyone pushing you to skip a security step. Each one is worth reporting.
If you're not sure whether something counts, report it anyway. A false alarm costs I.T. a few minutes to check. Staying quiet about a real incident can cost the company far more, and take much longer to fix. Every unreported hour gives an attacker more time to spread, more time to steal data, and more time to erase the evidence behind them.
Silence is never the safe choice. As one incident responder put it: the report that turns out to be nothing is never wasted. It's the one you don't send that costs everyone. Three categories deserve a report every time: unauthorized access to an account or system, exposure of sensitive data to the wrong person, and any malicious activity like malware or ransomware on a device.
Trust the pattern, not the excuse. Unauthorized access, exposed data, and malicious code all deserve a fast report, the moment you notice, not the moment you're sure. If something feels off, contact I.T. security right away. You don't need proof, and you don't need to be certain, you just need to be quick.
