When drilling down with Investigative reports, by default, both blocked and permitted actions are included in reports. This can be misleading when trying to interpret bandwidth consumption or hits as Websense includes an estimate of bandwidth that would have been consumed if the user was allowed to the site (even if they were blocked). It would be VERY useful to perhaps have a toggle button on the investigative reports page that allows one to turn off whether blocked actions are included in the reports.
I regularly have clients saying that a user is showing up as consuming X bandwidth for a site when that site is in fact blocked, only to have to tell the client that the bandwidth is what they "saved" according to Websense.
With Presentation reports, we can get around this by only selecting the Permitted actions when customising reports, and this limitation with Investigative reports sometimes renders it useless for a particular purpose.