As a security goon, you get pretty detailed reporting on who did what with the email... but you have to decide what to do with it. Punishing and mocking people

As a security goon, you get pretty detailed reporting on who did what with the email... but you have to decide what to do with it. Punishing and mocking people doesn't work. A good head of security should be _excited_ for someone who's interested in digging deeper. There's a lot of talk in our field about outreach for security-minded devs and sysadmins (usually called a security champion program).