The problem I see with locking things down is that you can't lock down things that the user requires for their job. If the user legitimately needs access to som

The problem I see with locking things down is that you can't lock down things that the user requires for their job. If the user legitimately needs access to some sensitive information for example, it's just a matter of time before they can be tricked by an attacker into doing something stupid with it. Yubikeys would solve the problem of the user giving away their credentials to the sensitive data but wouldn't stop the user directly giving away said sensitive data. Locking down is also a blacklist approach where you can miss something and it will be exploited when an attacker eventually gets lucky. I'd rather be the one getting lucky and catching those users early than waiting for an attacker to catch them. I guess instead of a penalty a more user-friendly way would be to attach monetary rewards to reporting phishing emails? That would incentivize reporting anything that looks even just slightly suspicious, which is probably a better outcome from a security point of view even with false positives.