I really wasn't calling to "fix the person." I agree with you. The email makes the situation appear as a process issue. Based upon the disclosure text, it se

I really wasn't calling to "fix the person." I agree with you. The email makes the situation appear as a process issue. Based upon the disclosure text, it seems quite possible the person wouldn't normally have clicked on an email text, but did so here based upon process. The disclosure displayed the attitude that they shouldn't have expected to get phished. It's 2017. Lots of people get phished. It's pretty straightforward to never click links that arrive in emails, to never enter passwords into webpages that open on their own. Of course there are technical ways to mitigate this specific attack, but it is more important not to excuse poor Internet hygiene after the fact.