> you'll end up with people trained not to click on links that look like phishing links but who will happily click on links that don't This is fair. I'll think

> you'll end up with people trained not to click on links that look like phishing links but who will happily click on links that don't This is fair. I'll think about it and do some more research. It'd be nice to be wrong, in this case :) > A "don't click on links" security culture does nothing to protect against "don't trust emails that tell you to do wire transfers." I thought this spoke for itself, but just in case: You can do both. A good policy takes all reasonable steps, of which these are good examples.