Because being vigilant works so well now... Knowledge isn't useful if you can't apply it in practice. My work's IT has a habit of sending out phishing emails

Because being vigilant works so well now... Knowledge isn't useful if you can't apply it in practice. My work's IT has a habit of sending out phishing emails that closely match emails legitimate emails our employees and vendors send. We're supposed to be vigilant for looking at the Reply-To field, which is hidden by default on mobile devices. (As is the url things are going to.) I will never not trigger those. Why? My brain can't tap the header field for every single email I read. And I can't ignore legitimate emails. Every time on my phone, I'll click the link, then check the url in the browser. I can't get my brain to check before clicking the link. (Trust me, I'm neuro-divergent and I'd tried for years. It won't reprogram.)