It's a culture problem. The real solution is to teach people to trust their security department.

If there's trust and respect, they'll reach out without fear of reprisal and inform right away when there's a problem.

If there's a culture of punishment, they'll fear the IT gestapo and try to cover up mistakes that could cost them their job.

It really is that simple.