Post-incident actions should fix systems, not just people

If the outcome of a review is more training, the review has probably stopped too early.

Somebody clicked something is where the analysis begins, not where it ends. The useful questions are why that click was sufficient, why it went unnoticed, and why the blast radius was that large. Actions aimed at the system change the odds next time; actions aimed at the individual mostly change who gets blamed.