Security incident report: log phishing, lost devices and leaks

The first hour after a security problem decides how bad it gets. People wait because they feel foolish, or they are unsure whether it counts. I want them to report anyway. A short form with plain questions is easier than writing an email to IT.

Before something happens

I put the link in the staff handbook and the welcome email, and I tell people: report, even if unsure, and nobody is blamed. I also name who reads the CSV and who gets a phone call. A form is not an alarm bell for an attack that is happening now.

While someone reports

The reporter gives the date, the kind of problem, what they saw, and whether personal data may be involved. Optional boxes cover what was affected and what they have done. Their AI might ask: "What did you notice?" Then "Which systems could be affected?" Then "Have you told IT?" It shows the answers and sends them only after a yes. See agent-fillable forms.

After the report

Someone reads each row the same day and decides the next step outside the form. People also search for a data breach report form. This covers the first report only. It does not stop an attack or tell any authority.

This is a form, not legal advice. Breach notice rules differ by place, so have a professional check your wording and your duties.

For a general workplace event, use an incident report. Close calls fit a near miss report. More tools are in IT and operations forms.

Questions

What if someone is not sure it counts as an incident?

They should report it anyway. The data question has a not sure choice, and the form never asks anyone to decide how serious it is. You triage the rows.

Why does the form not ask for logins or codes?

It must never collect them. The help text says so, and the API rejects fields that ask for secrets. Reporters describe what they saw, and IT handles access.

How do I handle reports quickly?

Turn on `notify_email` for a notice on each new report, and read the `still_happening` column first. A signed webhook can also pass reports to your ticket tool.

Or paste the JSON

Give this to your AI. It needs the AI Form API MCP server or an API key. It makes the form and sends you the link.

text

Create this form with the AI Form API create_form tool (or POST https://aiformapi.com/v1/forms with my API key). Then reply with the public_url.

{
  "title": "Report a security problem",
  "description": "Report it even if you are not sure. A quick report is more useful than a perfect one.",
  "fields": [
    {
      "id": "reporter_name",
      "label": "Your name",
      "type": "short_text",
      "required": true,
      "max_length": 150
    },
    {
      "id": "reporter_email",
      "label": "Email we can reach you on",
      "type": "email",
      "required": true
    },
    {
      "id": "discovered_date",
      "label": "Date you noticed it",
      "type": "date",
      "required": true
    },
    {
      "id": "discovered_time",
      "label": "Approximate time",
      "type": "short_text",
      "max_length": 50
    },
    {
      "id": "incident_kind",
      "label": "What kind of problem is it?",
      "type": "single_choice",
      "required": true,
      "options": [
        "Phishing or fake message",
        "Lost or stolen device",
        "Suspicious sign-in or access",
        "Malware or ransomware",
        "Data sent to the wrong person",
        "Unauthorised entry to a building or room",
        "Other"
      ]
    },
    {
      "id": "systems_involved",
      "label": "What may be affected?",
      "type": "multi_choice",
      "options": [
        "Email",
        "Cloud files",
        "Customer records",
        "Finance system",
        "Laptop or phone",
        "Website",
        "Not sure"
      ]
    },
    {
      "id": "what_you_saw",
      "label": "What did you see?",
      "type": "long_text",
      "required": true,
      "help": "Describe it in words. Do not paste anything that grants access.",
      "max_length": 3000
    },
    {
      "id": "personal_data_involved",
      "label": "Could personal data be involved?",
      "type": "single_choice",
      "required": true,
      "options": [
        "Yes",
        "No",
        "Not sure"
      ]
    },
    {
      "id": "steps_taken",
      "label": "What have you done so far?",
      "type": "multi_choice",
      "options": [
        "Disconnected the device",
        "Told my manager",
        "Told IT",
        "Changed my own access",
        "Nothing yet"
      ]
    },
    {
      "id": "others_affected",
      "label": "How many other people may be affected?",
      "type": "number",
      "min": 0,
      "max": 100000
    },
    {
      "id": "still_happening",
      "label": "It may still be happening",
      "type": "checkbox"
    },
    {
      "id": "evidence_link",
      "label": "Link to a screenshot or message",
      "type": "url"
    }
  ]
}

Or call the API

bash

curl -X POST https://aiformapi.com/v1/forms \
  -H "Authorization: Bearer $AIFORMAPI_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title":"Report a security problem","description":"Report it even if you are not sure. A quick report is more useful than a perfect one.","fields":[{"id":"reporter_name","label":"Your name","type":"short_text","required":true,"max_length":150},{"id":"reporter_email","label":"Email we can reach you on","type":"email","required":true},{"id":"discovered_date","label":"Date you noticed it","type":"date","required":true},{"id":"discovered_time","label":"Approximate time","type":"short_text","max_length":50},{"id":"incident_kind","label":"What kind of problem is it?","type":"single_choice","required":true,"options":["Phishing or fake message","Lost or stolen device","Suspicious sign-in or access","Malware or ransomware","Data sent to the wrong person","Unauthorised entry to a building or room","Other"]},{"id":"systems_involved","label":"What may be affected?","type":"multi_choice","options":["Email","Cloud files","Customer records","Finance system","Laptop or phone","Website","Not sure"]},{"id":"what_you_saw","label":"What did you see?","type":"long_text","required":true,"help":"Describe it in words. Do not paste anything that grants access.","max_length":3000},{"id":"personal_data_involved","label":"Could personal data be involved?","type":"single_choice","required":true,"options":["Yes","No","Not sure"]},{"id":"steps_taken","label":"What have you done so far?","type":"multi_choice","options":["Disconnected the device","Told my manager","Told IT","Changed my own access","Nothing yet"]},{"id":"others_affected","label":"How many other people may be affected?","type":"number","min":0,"max":100000},{"id":"still_happening","label":"It may still be happening","type":"checkbox"},{"id":"evidence_link","label":"Link to a screenshot or message","type":"url"}]}'

JSON definition

json

{
  "title": "Report a security problem",
  "description": "Report it even if you are not sure. A quick report is more useful than a perfect one.",
  "fields": [
    {
      "id": "reporter_name",
      "label": "Your name",
      "type": "short_text",
      "required": true,
      "max_length": 150
    },
    {
      "id": "reporter_email",
      "label": "Email we can reach you on",
      "type": "email",
      "required": true
    },
    {
      "id": "discovered_date",
      "label": "Date you noticed it",
      "type": "date",
      "required": true
    },
    {
      "id": "discovered_time",
      "label": "Approximate time",
      "type": "short_text",
      "max_length": 50
    },
    {
      "id": "incident_kind",
      "label": "What kind of problem is it?",
      "type": "single_choice",
      "required": true,
      "options": [
        "Phishing or fake message",
        "Lost or stolen device",
        "Suspicious sign-in or access",
        "Malware or ransomware",
        "Data sent to the wrong person",
        "Unauthorised entry to a building or room",
        "Other"
      ]
    },
    {
      "id": "systems_involved",
      "label": "What may be affected?",
      "type": "multi_choice",
      "options": [
        "Email",
        "Cloud files",
        "Customer records",
        "Finance system",
        "Laptop or phone",
        "Website",
        "Not sure"
      ]
    },
    {
      "id": "what_you_saw",
      "label": "What did you see?",
      "type": "long_text",
      "required": true,
      "help": "Describe it in words. Do not paste anything that grants access.",
      "max_length": 3000
    },
    {
      "id": "personal_data_involved",
      "label": "Could personal data be involved?",
      "type": "single_choice",
      "required": true,
      "options": [
        "Yes",
        "No",
        "Not sure"
      ]
    },
    {
      "id": "steps_taken",
      "label": "What have you done so far?",
      "type": "multi_choice",
      "options": [
        "Disconnected the device",
        "Told my manager",
        "Told IT",
        "Changed my own access",
        "Nothing yet"
      ]
    },
    {
      "id": "others_affected",
      "label": "How many other people may be affected?",
      "type": "number",
      "min": 0,
      "max": 100000
    },
    {
      "id": "still_happening",
      "label": "It may still be happening",
      "type": "checkbox"
    },
    {
      "id": "evidence_link",
      "label": "Link to a screenshot or message",
      "type": "url"
    }
  ]
}

A security incident report that gets the first hour right