You noticed something odd, and you’re not sure how to tell the owner.
An email that doesn’t sound right, a window that appeared on its own, a customer who got a message from you that you didn’t write. You work with the owner every day, and you’re weighing whether this is worth their time.
The owner chose the person who looks after the computers, and mostly that works. Your IT person and your owner can only act on what reaches them, and most of what reaches them comes from staff. A note from you is a dated observation. It isn’t a verdict on anyone.
Write four lines before you walk in
An example, with an invented date: “On Tuesday, October 20, at about 10 a.m., the front desk computer showed a window telling me to call a number. I didn’t click anything and I haven’t closed it.”
- What you saw, in the words on the screen. Photograph it with your phone instead of closing it.
- When you first noticed it, and when things last looked normal.
- Where: the computer name and the account, such as the front desk computer or your email address.
- What you did afterward, including nothing.
How to open the conversation
Pick a private moment and bring your phone with the photo on it. Five minutes at a desk with the screen in front of you beats a hallway remark that gets forgotten by lunch.
The owner has three choices: leave it, ask the current IT person, or ask us for a second look. All three are reasonable. Your part is to make sure they have the facts to pick one.
- Start with the event: “I want to show you something I saw on Tuesday.”
- Leave out verdicts such as “someone got in” or “IT missed this.” You don’t know yet, and neither does anyone else.
- Hand over the decision: “Do you want to have your IT person look at it?”
Questions the owner will probably ask
Having these answers written down is what makes the five-minute conversation useful.
- Who saw it, and how many people use that computer?
- What did anyone click, type, or open?
- Is anything different on that computer or in that account now?
- Did money move, or did anyone ask for money to move?
- Where is the screen now?
When it shouldn’t wait for a good moment
If the thing involves money, a locked screen, or an email that asked someone to pay or change bank details, tell the owner by voice the same day. FTC guidance on responding to a breach starts with getting the right people involved right away and naming one point person to pass information along. In a small office, that is usually the owner.
Keep what you saw. FTC guidance says not to destroy evidence, so leave messages in the mailbox and leave the window as it is until someone has looked.
If the owner is busy or waves it off
- Leave a copy of the four lines, dated, and keep one yourself.
- Say “I’ll make a note of it in case it happens again.” That keeps the door open without a debate.
- A second sighting, from you or from anyone else, goes on the same page with its own date. Two dated lines are easier to act on than one.
Agree on a place to send these
CISA’s Cyber Essentials asks leaders to set up an internal reporting structure so that problems are detected, communicated, and contained. In an office of 10 to 50 people, that can be one named person and one email address that the whole staff knows. Ask the owner to pick them. After that, nobody has to wonder whether a small thing is worth mentioning, and the owner stops hearing about problems by accident.
What this note does and doesn’t establish
A written observation doesn’t mean something happened. Many of them turn out to be ordinary, and the owner can still decide. If the owner asks us to look, a person reads what we find and reports it with dates, including what we couldn’t determine.
You’re not telling the owner something is wrong. You’re handing them what you saw so they can decide.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.