Which of the following BEST demonstrates a security-conscious organizational culture?

While reporting incidents is good, directing all reports immediately to senior management is not scalable or efficient and doesn't inherently demonstrate widespread employee security consciousness as much as employees reporting anything suspicious.

Establishing and tracking security awareness metrics indicates a program's effort, but not necessarily the actual cultural adoption of security by employees, which is better shown through their actions.

Phishing simulations are a tool for training, but their existence doesn't alone demonstrate a pervasive security-conscious culture; it's the employees' response and subsequent reporting that would.

When employees identify potential incidents and proactively report them, it demonstrates a strong security-conscious culture. This indicates that security is understood as a shared responsibility, employees are trained and empowered to act, and they feel comfortable contributing to the organization's overall security posture.