End users are often the "boots on the ground" that have the closes interactions with incidents. These subject matter experts should be encourages to report suspicious occurrences because they are mostly likely to: a) identify an occurrence as suspicious b) be in a position to observe the occurrence.