Initial intrusion includes gaining foothold on individual workstations/personal computers. The idea being that a) endpoint security is always a shit show and b)

Initial intrusion includes gaining foothold on individual workstations/personal computers. The idea being that a) endpoint security is always a shit show and b) social engineering is the bomb. I think after doing the obvious stuff with your core infrastructure and making sure you have good data backup and recovery procedures in place, the next best use of resources is in trying to make sure your employees don't fished.