Phising and phishing education are inherently misguided. If my normal workflow includes much the following, then phishing will always eventually succeed: - HTM

Phising and phishing education are inherently misguided. If my normal workflow includes much the following, then phishing will always eventually succeed: - HTML emails where links and remote images obfuscate the 'real' content of the email. - URLs which are not clearly and easily human-readable. - A workflow where my normal and expected daily behavior is to receive valid emails that I don't recognizes with URLs from vendors, and then I'm meant to click on those URLs, go to web pages, and enter my credentials. The fact that _any_ normal products or business processes expect this means phishing will always eventually succeed. No, I don't have all the UIs and URLs for every vendor memorized. I'd have no way to know if they changed validly, and my job trains me on a daily basis to click on emails and enter my credentials. It's just that _every so often_ this same scenario is set up by a bad actor.