>Training is inadequate, with most security and IT orgs making excuses for their users Training? Everytime a user has been phished their manager says "nono it

>Training is inadequate, with most security and IT orgs making excuses for their users Training? Everytime a user has been phished their manager says "nono it cant be that they clicked something and logged in, they are very careful :)" Its never the users fault. IT is not making excuses, the business is. No business wants to say "yea we have shit security and we hire numbnuts" MFA + AAD risk users block + impossible travel block + turn off basic auth w conditional access helps a lot.