diff --git a/modules/security/suspicious-login-monitor.sh b/modules/security/suspicious-login-monitor.sh
index d087eda..3e22f5d 100755
--- a/modules/security/suspicious-login-monitor.sh
+++ b/modules/security/suspicious-login-monitor.sh
@@ -2533,7 +2533,7 @@ check_suspicious_network_activity() {
 perform_compromise_detection() {
     local ip=$1
 
-    echo "  ${YELLOW}Running comprehensive compromise detection...${NC}" >&2
+    echo -e "  ${YELLOW}Running comprehensive compromise detection...${NC}" >&2
     echo "" >&2
 
     # Load baseline for comparison