It happens all the time at my work place. I work at a big company and I get emails from random people in the company to go to submit info to random places on th

It happens all the time at my work place. I work at a big company and I get emails from random people in the company to go to submit info to random places on the Internet, usually related to employee benefits or surveys. I always report them as suspicious and move on with my work. Once in a while you'll see a follow up email from the sender saying that they are aware of many people reporting the email as a phishing attempt and that reporting the email was wrong and that link to that particular website is a company approved tool and that employees are required to complete the survey at the link for some department or center's benefit. This wouldn't be a problem if we had internal websites with standard tools like a survey builder and such, but getting our IT contractor in my org to do the basic functions of their jobs takes a herculean effort, getting them to support a basic internal tool would be a multi-year campaign. I can appreciate how much easier (and cheaper) it can be to use external tools and train users to disobey IT and security recommendations about phishing. The problem with bureaucracies and hackers is that both will take the path of least resistance, and the hard problem of IT security in large orgs is how to separate the two into distinct categories.