D, full transparency, hold an all hands meeting, admitting this was a human vulnerability, not a technical failure, and outline improvements to come.

Yeah, and so many interesting options there.

Well, first off, before I give you an answer, let's kind of talk about dealing with an employee who may have made a mistake or been a victim of a crime.

I am not HR, right? So while we care about insider threat, the people that really make those decisions about what to do with an employee that's kind of acted out of step with company policies, that's an HR decision.

So I think at this point, I'm working with them and what they want to do, there's precedent to it, there's laws, there's norms, risk tolerance, and that really kind of would fall under them.

But I would not move to publicly shame the researcher because I don't think that is sending the right message to the rest of our employees.

But I think if morale is getting hit, I think if there's a lot of information out there, the best thing to do would be to come up with something internal.

That's not your call.