> Opening a phishing email should not be considered a failure. The email client is specifically designed to be able to display untrusted mail. I'll go further:

> Opening a phishing email should not be considered a failure. The email client is specifically designed to be able to display untrusted mail. I'll go further: It is impossible to never open a phishing email. From addresses can be spoofed. Path information... well, it isn't available at all unless you open the email, is it? Also, it can be spoofed right up to the point it enters your company's email system. The Subject can be made appropriate and innocuous, or it can be made just as "OPEN THIS EMAIL IF YOU WANT TO KEEP YOUR JOB!" as the sender desires, and there isn't a person on Earth who has to respond to emails who will be able to divine the inner intent of the sender from just the Subject line. Should corporate email systems prevent address spoofing? Argue amongst yourselves. My point is, they don't, or at least they haven't anywhere I've worked.