> You need to find some resources or setup training to combat phishing. Honesty it’s so bad I think we’re best off just figuring out ways to do away with email

> You need to find some resources or setup training to combat phishing. Honesty it’s so bad I think we’re best off just figuring out ways to do away with email as a primary communication mechanism altogether. When my company was smaller we had more technically savvy people, but as we’ve grown the average level of competence has sunk just to meet staffing needs and it’s impossible to keep up with training and expect people to actually really listen. So if I had my druthers it would be a blanket ban on email for all internal communication. Formal taskings get done through a PM tool, general requests for information done through Slack, and documents managed and shared by the GDrive. Email restricted only to communication with outside partners. All links and URLs are blocked. All attachments are stripped and send an email telling them to send it via an upload portal that pings the person on Slack that they have a [filename] waiting for them. Part of the problem is how much we’ve habituated people’s email habits to behave badly. We tell people over and over again not to blindly click URLs, and then by default Microsoft Teams is here emailing people every time they get mentioned in a chat with a big “view in Teams” button to click through. Users get mixed messages all the time so can we blame them for not knowing what to do? And the worst part is that the worst actors in this request are senior executives. The higher up the chain the less regard they have for following established processes.