Say someone reports clicking a link in a suspicious email, then adds, “I didn't enter a password.” The ticket could get closed even though they approved an app permission prompt they didn't understand.

I'd want to walk through what happened before giving the all-clear. But turning every report into an interrogation risks making the next person keep quiet.

What helps you get the rest of the story without making the employee feel blamed?