Investigating Web Misuse with Firewall Reporting

If you’re in human resources, you know the drill: A manager comes to you after an employee misses several deadlines. They’ve also noticed YouTube regularly playing on the employee’s monitor and want your help working out whether it’s affecting their work. An employee reports that a colleague keeps sending them offensive links in Teams. Someone in accounting is worried a confidential file may have been uploaded to an unapproved AI tool. And now it’s your job to hear everyone out, piece together what happened, and work out what, if anything, needs to happen next.

When you’re investigating web misuse, you need to understand what happened online and how it relates to the complaint. This is where the back-and-forth with IT usually starts. You ask about what was happening on a specific date and time. IT finds connections to YouTube, but a list URLs and timestamps tells you little about what was playing or whether it interfered with the work. You have follow-up questions, and someone in IT has to go back through the logs. This can be frustrating and time-consuming, especially when you’re staring at a spreadsheet full of IP addresses, missing usernames, and timestamps that don’t tell you what someone was actually doing. Sometimes it’s just plain hard to tell what you’re looking at.

Fastvue Reporter’s firewall reporting software turns recorded firewall activity into reports HR can use, without IT having to translate. Where the firewall identifies the user, you can select the employee and the dates the manager flagged, review the recorded browsing activity, and decide what needs to be discussed. It also saves you another frustrating call with the IT team.  

A bullying or harassment complaint will rely on different evidence. If an employee says a colleague is repeatedly messaging them crude or hurtful comments, you’ll want to know what exactly was said, when, and whether the contact is a pattern of inappropriate conduct. 

With optional email and chat monitoring enabled, HR  can quickly review flagged emails and Teams messages alongside web activity, then check those records against what the people involved tell you, helping you avoid the dreaded game of “he said, she said” when accounts differ.

What counts as web misuse in the workplace?

Web misuse is the use of websites, apps, or online services in a way that breaches an employer’s acceptable use policy or workplace conduct rules. Examples include personal browsing that interferes with work, deliberately accessing prohibited content, uploading confidential files to an unapproved AI tool, or using Teams to harass a colleague.

For example, if your policy allows occasional personal browsing, a YouTube entry in a firewall report is no breach on its own. If a manager says an employee missed a deadline because they were watching videos, HR still needs to establish whether the viewing affected their work.

When does personal browsing become a performance management issue?

We've said it before: nobody wants to be the fun police. And depending on your company culture and employees' responsibilities, watching videos, browsing the web, and reading the news may all be part of the job. The key here is context.

'Cyberslacking' (also known as cyberloafing) occurs when someone uses the web to, well, slack off. This usually looks like employees using work time to scroll through social media (for hours), get stuck into the latest Netflix series, or do some Christmas shopping for their kids, uncles, neighbors — you get the picture. And while the occasional online grocery haul or cute cat video may actually be a welcome break, excessive personal browsing can be a big distraction, with an even bigger impact on productivity. Recent stats from Resume Now suggest 60% of workers in the US lose a month a year to online distractions, with social media and video streaming being the biggest culprits.

How can cyberloafing affect productivity and network security?

Lost time and a drop in employee engagement: Personal browsing can interrupt work tasks, contribute to missed deadlines, and leave frustrated colleagues picking up unfinished work.

Bandwidth strain: Video streaming and large downloads can consume network capacity, diverting it away from genuine business applications.

Policy breaches: Visiting prohibited websites, unapproved services, or tools to bypass restrictions can undermine your acceptable use policy and network security controls.

Exposure to potential threats: Unsafe downloads, deceptive adverts, and malicious websites expose company devices and accounts to malware or credential theft. Shadow AI, where employees use AI tools without company approval, adds the risk of confidential documents, customer information, or employee records being uploaded to services the business has not assessed for security risks.

What should the HR team look for?

HR's concern isn't whether someone accidentally clicked a YouTube link from a personal email. It's whether that activity interferes with someone’s responsibilities or breaches company policy. You should review the pattern of online activity alongside the employee's role, work output, and explanation before coming to any conclusions.

One Fastvue Reporter customer shared an example of an employee who was regularly overheard streaming a popular YouTube gamer. Management ran a report and confirmed the employee was accessing YouTube for hours each day. But the reports also showed activity across the websites they needed for work, and the employee was still meeting their KPIs. When asked, they explained that the background noise helped them concentrate.

Yes, the browsing warranted a conversation, but the wider context gave management a different picture. Clear web usage reporting helps you make that assessment without treating every personal website visit as a performance issue.

Online abuse and harassment: when digital behavior harms others

Offensive links shared with colleagues, repeated threatening messages, or unwanted contact that follows someone across online platforms can raise concerns about bullying, harassment, or cyberstalking. In the Workplace Bullying Institute’s 2024 U.S. survey, 32% of adult Americans reported having experienced workplace bullying.

What risks are associated with online abuse and harassment?

• Harm to employees: Threats, sexual comments, or repeated unwanted contact are psychosocial hazards that can cause distress and make it harder for someone to do their job. They may start avoiding a Teams channel they need for work because opening it means facing another round of comments.
• Wider exposure: A comment sent in a direct message has one recipient. Post it in a Teams channel or forward a screenshot and the audience grows. Colleagues may join in, and the person targeted may have no idea who else has seen it.
• Damage to employee relations: If employees see abusive messages go unchallenged, they may lose confidence that anyone will act on their own complaints. The EEOC identifies fear of disbelief, inaction, and retaliation as reasons employees hesitate to report harassment.
• Legal ramifications: Online conduct can raise discrimination concerns when someone is targeted because of a protected characteristic, such as race or sex. How the organization responds, and how the employee is treated after raising the concern, can also matter if the complaint is later challenged.

What should the HR team look for?

Start with the exchange the employee reported. What was said or shared, who received it, and what happened next? If unwanted contact is the concern, check whether it continued across email, direct messages, or group chats. A screenshot can give you a starting point, but it may leave out earlier messages, replies, or people who saw the exchange.

Use the evidence that fits the complaint. A firewall report may help establish when a website was accessed. If the concern is what a colleague wrote in Teams, you’ll also need the relevant message and the surrounding conversation. Review these alongside the accounts of the people involved, including how the behavior affected the employee’s work.

Investigating web misuse: Six steps for a fair HR investigation

Whether you're investigating excessive personal browsing on network devices, access to inappropriate content, or a workplace bullying accusation. The initial concern is only part of the picture. As a human resources manager, your role is to establish what happened, consider the employee's explanation, and assess the evidence against company policy.

SHRM's guidance on workplace investigations emphasizes checking accounts against supporting evidence and remaining open to alternative explanations. Clear user activity reports are one of the most valuable tools in your investigation toolkit, helping you examine concerns, including information that may challenge the original allegation.

Drawing on established workplace investigation guidance, these six steps provide a practical framework for reviewing concerns fairly, with Fastvue Reporter supporting the evidence-gathering and analysis stages.

1. Establish the concern and check the relevant policies

Identify what has been reported, who may be affected, and over what time period the activity occurred. Check which policies apply, whether that's acceptable use, confidentiality, anti-harassment, or your code of conduct. The aim is to establish what happened through a fair review, without assuming a violation.

2. Gather and preserve relevant evidence

Depending on the concern, you may need emails, chat messages, documents, witness accounts, and online activity reports. Identify the relevant sources early and arrange to preserve records and online activity reports. Identify the relevant sources early and arrange to preserve records that could be deleted or overwritten. While this may sound a bit dramatic at first, serious web misuse can and does lead to dismissals- the last thing the company wants is to make a decision and discover it cannot produce the evidence behind it when the outcome is challenged.

Fastvue Reporter helps you examine the online activity involved. For browsing and productivity concerns, start with an User Overview Report focusing on internet usage, then  then use an Activity Report to examine relevant sessions and build a timeline.

For a breakdown of this workflow, check out our article on Reporting on Employee Internet Usage During Work Hours.

For bullying or other concerning behavior, run a Safeguarding Report and filter by web activity or email and chat, depending on the concern and the monitoring enabled. The report brings together flagged activity relating to cyberbullying, extremism, self-harm, adult content and profanity, and drugs, helping you identify incidents that warrant closer review. Email and chat monitoring requires the optional add-on.

3. Interview the people involved

Speak separately with the person raising the concern, the employee whose conduct is being investigated, and relevant witnesses. Explain the purpose of the meeting, how the information will be used, and that no conclusion has been reached. Protect people's privacy as far as possible but avoid promising absolute confidentiality when information may need to be shared to investigate properly.

Start with open questions based around facts, then clarify details. Encourage employees to be as specific as possible. Useful questions may include:

• What happened, and when?
• Which websites, applications, or communication channels were involved?
• Was this an isolated incident or part of a pattern?
• Who else might have relevant information?
• Are there messages, documents, or other records we should review?

The University of Tennessee’s investigation guidance recommends exploring the circumstances, frequency, impact, and available supporting evidence, while giving the person accused an opportunity to respond.

Use the data from Fastvue reports to ask specific, neutral questions.

 “Can you explain this activity during Tuesday’s shift?” leaves room for an answer. “Why were you wasting time?” assumes you already have one.

For bullying or harassment concerns, ask about the surrounding communication and its effect on the person involved. Take clear notes, clarify anything ambiguous, and follow up on new evidence or witnesses identified during the conversation.

4. Assess the findings and credibility

Compare the employees’ accounts alongside any relevant witness statements with reports and other evidence. Your HR team should consider information that supports or challenges the allegations and follow up on discrepancies before reaching a conclusion.

According to California's Civil Rights Department's 2025 Harassment Prevention Guide, when people give different accounts of an incident, assess each explanation against the available evidence. A lack of independent witnesses does not, on its own, mean the complaint is unfounded. Similarly, an absence of screenshots or logs does not automatically make a complaint unfounded.

For digital evidence, check:

Attribution: Does the record identify the employee's account reliably? Could shared access or a compromised account affect the conclusion?

Context: Does the surrounding activity support the explanation?

Meaning: Does the record show a blocked request, a completed connection, or an upload that still needs verification?

Consistency: Do timestamps and records align with the accounts given?

Assess the evidence as a whole, using the standard required by your organization's procedures and applicable requirements.

5. Prepare the investigation report

Write the report so someone unfamiliar with the case can understand what was alleged, what you checked, and how you reached the findings.

Include:

The concern and scope: The Allegations, any relevant policies that were breached and the time period investigated.

The evidence: Any interviews, Fastvue reports, internal communications, and other supporting records.

The analysis: Where accounts agreed or conflicted, how discrepancies were examined and why particular evidence carried weight.

The Findings: A conclusion for each allegation, with any unresolved questions or limitations clearly identified.

The EEOC recommends documenting complaints from intake through resolution and preparing a written record of findings and actions. Keep supporting evidence organized and access limited to the appropriate people.

6. Support the decision and follow up

Your final step  is to connect the findings with an appropriate  response. Consider the seriousness of the conduct, relevant company procedures, applicable employment laws and labor regulations, and how comparable cases have been handled. Consistent policy enforcement helps employees and managers understand the standards expected.

The response may include:

• Performance management: Clarify expectations, address recurring performance issues, and agree on a review period.
• Conduct-related action: Apply appropriate disciplinary measures where the evidence supports a policy violation.
• Network security measures: Work with IT teams to address compromised accounts, inappropriate network access, or other potential threats.
• Training and support: Close gaps in employees’ knowledge of approved tools, confidentiality requirements, or workplace behavior.
• No further action: Record when the evidence does not establish a violation, without treating an unsubstantiated complaint as deliberately false.

For established harassment, the EEOC recommends prompt, consistent and proportionate corrective action. Communicate the outcome appropriately, protect confidential information,n and follow up to check whether the behavior has stopped or retaliation has occurred.

How can HR investigate concerns across email and workplace chat?

When a complaint involves threatening messages, inappropriate links,s or unwanted contact, browsing records and traffic patterns may not be the best place to start. The HR department will need to examine the relevant communication, including who sent it, who received it, and the circumstances around it.

Fastvue Reporter's optional Microsoft 365 email and message monitoring brings supported email and Teams into your reports alongside web activity. With the relevant sources configured, your HR team can use the Safeguarding Report to review flagged communications as part of an investigation.

Optional Fastvue AI Risk Assessment adds another layer of context, assessing flagged activity and assigning a risk level, explanation, and confidence score. This helps HR teams prioritise potentially serious incidents, reduce false positives, and focus their attention on communications that warrant closer human review.

Where network visibility helps HR, and where the evidence has limits

Investigating web misuse can lead to decisions about employee conduct policies, network access, and continued employment. For the human resources department, those decisions need reliable data, clear policy management, and a fair process. Ignoring potential threats or acting on incomplete evidence can create wider problems for your organization.

Legal ramifications. Mishandled complaints or disciplinary decisions can lead to discrimination, retaliation, or other employment claims. Losing relevant digital evidence can create additional problems if the outcome is challenged. Fastvue Reporter’s configurable data retention policy helps your organization manage how long activity records are kept. Once a complaint arises, preserve the relevant reports and underlying records before routine deletion removes them, and review whether a legal hold is needed.

Financial costs and diverted resources. Legal fees, settlements and damages take resources away from organizational goals. Investigations also consume time across human resources, IT teams, and management. The EEOC recovered almost $660 million for discrimination victims in fiscal year 2025.

Reputational damage. How your organization handles inappropriate behavior can affect its reputation with current and prospective employees. The EEOC’s review of workplace harassment research identifies reputational harm and difficulty attracting employees among the wider business costs. Clear policies and consistent policy enforcement help set expectations for how concerns will be addressed.

Lower employee satisfaction, morale and trust. Poor handling of workplace concerns can damage employee relations and discourage employees from speaking up. Unresolved harassment can also affect workplace performance, productivity,,y and employee retention, including among colleagues who witness the behavior.

From web activity reports to fair HR decisions.

When you’re investigating web misuse, the concern that lands on your desk shapes the evidence you need. If a manager raises a performance issue, review browsing activity alongside the work the employee was expected to complete. If someone reports threatening messages, review what was said, who received it, and whether the contact continued.

Fastvue Reporter gives your HR team clear web activity reports you can review without asking IT to translate raw firewall logs. With optional email and chat monitoring, you can also review flagged emails and chat messages alongside web activity. From there, you can ask specific questions of the people involved, weigh their explanations against the records, and document why the evidence supports the next step.

FAQs about investigating web misuse in the workplace