Audit sign-ins and activity

A senior manager’s account showed a sign-in from an unfamiliar IP an hour ago and then opened files in a confidential channel. I do not know if this was a legitimate travel or a compromised credential. The manager is reachable but likely in meetings until evening. What is the most likely explanation and the best immediate steps to contain risk without unnecessarily locking the account and halting work?

Every month we chase five to ten sign-in alerts that turn out to be benign travel or VPN quirks and that wastes analysts’ time and undermines urgency. Recommend one habit change and one concrete rule for alert tuning that reduces noise while keeping us sensitive to real compromises. Also say how to measure whether the change works over the next quarter.