An employee who sees a flaw, or flaws, in his or her companys network security, brings the problem to management but gets ignored or punished. The worker either goes public or files a complaint with a federal regulatory agency like the Securities and Exchange Commission. Such a scenario is unlikely to end well almost certainly for the company (if the complaint is credible) and perhaps even for the whistleblower, notwithstanding laws meant to protect them. The SEC offers 10 percent to 30 percent of a settlement of more than $1 million to qualifying whistleblowers.”]
Source: https://www.csoonline.com/article/3034529/cybersecurity-whistleblowers-get-ready-for-more.html