I worked for a startup in 2020 as a contractor and they hired a security firm to audit us. Part of that was detailing how susceptible the company employees were

I worked for a startup in 2020 as a contractor and they hired a security firm to audit us. Part of that was detailing how susceptible the company employees were to social engineering. What I noticed then is a notification appeared in my calendar that looked like an invitation to a regular zoom appointment. But when you opened the 'meeting' it prompted you to install an exe. I actually think they were using the same vector here. So this whole calendar bug has been known and exploited for a long time. I get the feeling almost everyone in our company installed the firms PoC malware, by the way. Because afterwards there were PowerPoints on how to avoid such attacks. It's kind of funny. You can invest a crap load in security to protect your companies assets. Taking into mind the most complex flaws you can imagine. But then a simple email campaign or event system ends up taking down an employee. Then they have access to all internal data. These kind of attacks are what the most prolific intruders are using today because they're so easy to mount and hard to defend against. Why invest it like months or years of R & D in the hope of finding a zero-day in some system when you can just get some random receptionist to trust you in a single phone call?