Report it to their supervisor or the security team — not investigate it independently. The training reinforces that suspicion alone is sufficient grounds to report, and that non-retaliation protections apply. Early reporting gives the organization options. Delayed reporting often doesn’t.