Comment by fc417fc802

I suppose that depends on context. I think it's important to be pragmatic regarding urgency. Of course the most urgent thing is to stop the bleeding; removing the bullet can probably wait until things have calmed down a bit.

If Joe dropped the production database and you're uncertain about his intentions then perhaps it would be a good idea to do the bare minimum by reducing his access privileges for the time being. No more than that though.

Whereas if you're reasonably certain that there was no intentional foul play involved then focusing on the individual from the outset isn't likely to improve the eventual outcome (rather it seems to me quite likely to be detrimental).