Following a ransomware incident, the incident response lead facilitates a post-incident review. The team confirms the malware entered through a workstation where a user opened a malicious attachment. The lead is not satisfied with stopping at 'a user clicked a link' and repeatedly asks why each contributing condition existed until the team identifies that the email gateway's attachment sandboxing had been disabled during a migration and never re-enabled. Which root cause analysis technique is the lead applying?