> I hear you on the risk with unsophisticated users who click things. The evidence says this attitude of "it's other people who get phished and not me" is pure

> I hear you on the risk with unsophisticated users who click things. The evidence says this attitude of "it's other people who get phished and not me" is pure arrogance. Practically all sophisticated security professionals can be phished with sufficiently sophisticated attacks, if the underlying system is using a phishable credential.