I've worked on security teams or for security teams for my entire career. Yes, some things are the security team's problem - as in, security teams are responsi

I've worked on security teams or for security teams for my entire career. Yes, some things are the security team's problem - as in, security teams are responsible for managing risk. My expectation is for them to do so. Again, you can perform phishing tests, but I think they're mostly a waste of time, a terrible substitute for real mitigations, and should never come at the cost of your employee's sanity - a security team must build trust with other teams first and foremost, not burn it because "real attackers are mean too". > dismiss standard methods and models My opinions are hardly controversial.