If you're letting arbitrary attachments in and allowing arbitrary executables to run then Sally is the victim of gross incompetence. Everyone has jobs to do an

If you're letting arbitrary attachments in and allowing arbitrary executables to run then Sally is the victim of gross incompetence. Everyone has jobs to do and they can't do them effectively if you need them to think through information security for every interaction. You have to build the rails and create a safe work area. User education is truly the last layer because if everything fails maybe the user will remember something we said. Rogue employees require a lot more traditional security and trust. Someone could always just physically destroy company property, and Sally could always approve fraudulent transactions, so you have to start there and it'll get you pretty far.