We are all very aware of what to watch out for and I trust that anyone with dangerous access is aware, but we're a small shop. I know that humans are the weak l

We are all very aware of what to watch out for and I trust that anyone with dangerous access is aware, but we're a small shop. I know that humans are the weak link, but my definition of a "seasoned security professional" is not the average Joe that would fall for it. Will some security people fall for it? Absolutely, but they don't deserve the title "seasoned". Especially not if always being cautious of phishing is part of their training/on-boarding. I'd say it makes that rule essential instead of useless.