The company I work at works with and contains a significant amount of PII regularly phishes on our staff. It’s usually between 1 in 5 and 1 in 4 that will click

The company I work at works with and contains a significant amount of PII regularly phishes on our staff. It’s usually between 1 in 5 and 1 in 4 that will click on the link. Despite all of the education and quarterly repeated phishes those number really aren’t improving much. I think at some point you have to accept that end users will click on things, and add additional protections in place to help mitigate the risk.