I find it concerning that after getting pwned through a relatively lazy phish, their reaction is to double down on training instead of implementing unphishable

I find it concerning that after getting pwned through a relatively lazy phish, their reaction is to double down on training instead of implementing unphishable second factor auth like they should have from the beginning. For everyone: If you have more than a handful of employees, one of them is guaranteed to be phished. If that can result in a meaningful compromise, work on your security until it doesn't. Then work on securing against attackers tricking that employee into downloading and running malware, because guess what, that's also going to happen.