Another option would be to hire a data security firm to do ongoing penetration testing at your business, perhaps even to the point of supplying employee email a

Another option would be to hire a data security firm to do ongoing penetration testing at your business, perhaps even to the point of supplying employee email addresses. Then if the business is penetrated by the security firm, they can give notifications of what needs to change, who needs to be educated about clicking on email links, etc.