What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
After thinking about this for a bit, and seeing the couple of (conflicting) answers that were offered, I realized - this is no different from your question on "What policies maximize employee buy-in to security?".
- Social norms (as per @Graham's answer there) - employees need to feel that they are expected to say something. Not quite "See something, say something" - more like "This is your office too, you'd say something if somebody walked into your home, wouldnt you?"
- Getting them to care.
- Priorities. Employees need to see that management cares about this too. Not by giving bonuses, but by actions. E.g. CEO goes over to a stranger... Or, contrarily, if an employee was late because he was questioning strangers or whatever, there shouldnt be repurcussions...
- Appropriate tools, much as @Graham mentioned here. Moreover, automate detection as much as possible! Invest in good tools for the job at hand, and remove as much as possible reliance on the people.
The policy that improves incident detection is a policy to equip security staff with automated monitoring tools that save them from the tedious legwork of scouring log files and performing manual detection. By analogy: you don't improve physical security by asking your guard to walk faster, you give him CCTV monitors.
I think the answer is a policy that rewards the reporting of unusual activity. IE software/hardware that is running abnormally slow, crashing unexpectedly, etc. The policy could also cover the discovery of bugs, misconfigured software/hardware, and poor practices.
In a healthy organization a lot of this activity should already be going on. IE users calling the help desk to report that their computer is running really slowly. The policy would just formalize the rewarding/recognition of employees who help discover incidents.