A security-awareness campaign reduces reported phishing clicks but also discourages employees from reporting mistakes. What should the manager change?

1. Treat fewer reports as definitive proof of fewer attacks
2. Remove all reporting channels
3. Promote timely reporting and assess both susceptibility and reporting behavior
4. Publicly shame more employees