Technologically, email aliases have been working wonders for me in personal use. No idea if it could be rolled out effectively for nontechnical users at an orga

Technologically, email aliases have been working wonders for me in personal use. No idea if it could be rolled out effectively for nontechnical users at an organizational scale though, even with automation. It also does little against compromised mailboxes - heck, a sufficiently advanced spear fish might even have better chances if the user misunderstands the security improvements this would provide. But I think other than this, there's not much else to fix. Some people are malicious, others get compromised. No fixing that.