Note: this answer is written in less than optimal circumstances (31 December...) so I will be back with edits when time permits. Do not hesitate to suggest changes or edit them yourselves.
From the perspective of someone working in information security, your situation is not uncommon.
First - anything mentioned in the answers (mine included) must be put in context of the country you are in. You may be in a place where anything you do is company property and you have zero expectations of privacy - up to places where your private activities on a company device are protected.
This also covers the case of your responsibility when using your device (except for gross misconduct): from places where you are responsible for protecting your devices yourself and take responsibility for that - to places where your liability is limited and the burden of the protection relies on the company.
You need to understand this context of yours first.
In the text below "we" refers to "the company" and "they", to the employees. It is centered around the case where they claim they "did not do it" but we believe they "did".
We have systems which record activity of employees (please keep the legal context in mind - in some places this is fine, in other not, in yet others nobody cares whether this is legal or not, and in yet another nobody cares to record).
We would present the employee evidence of their activity (with the "go" from legal/HR) in the course of the interaction with them. This evidence would show that user ABC did XYZ at time TTT.
Please note that we just know that the user ABC, as registered in our systems, did something. This does not mean that the actual human who is normally associated with the account ABC did it.
There are many cases where ABC does not match the human:
- we were hacked and someone used account ABC for that
- an administrator acted as ABC
- someone used ABC account when the human was not at the keyboard
- someone saw the human typing their password and later that someone connected to ABC account
- ... and plenty of other cases
These are all reasonable claims which can be done - not to counter the evidence, but to challenge the link. (the evidence can certainly be tempered with in some cases, and this is also something which can be investigated)
It can be that we/the authorities prove that the human was the one using account ABC. Case closed.
It can be that we see that the human was not using the account ABC. In that case we need to determine whether
- it is their fault (did not lock the device while explicitly asked to - for instance)
- or not (the company was hacked, they were tricked into an action they could realistically fall for ( we are all humans), ...)
As you see such cases are not obvious and, sure, there are the easy cases (which end with eyes rolling or jail) but a lot are not that obvious. They often land in the gray zone, especially in places which are either not clean-cut in terms of company vs. user responsibility, or extremely specific and then the employee and the company have a ping-pong game of "it is your responsibility", "no, it is yours".
To be honest, I have a hard time understanding your question which jumps from "I have no password on my device", to "I let everyone use them", and to some kind of sync between searches. If I may recommend to clean that up (and stick to facts - and their consequences), I would be glad to comment further
Have anxiety and never read the pop ups
Please do, this makes everyone's life easier and more secure.