Ive argued for a while: the value of these programs is to solve the management problem. When you propose a security solution, someone is going to say "oh my us

Ive argued for a while: the value of these programs is to solve the management problem. When you propose a security solution, someone is going to say "oh my users are too smart to be phished, don't worry about this". Ive had this argument for rolling out mfa at nearly every company ive worked with. Phishing tests give you the "well actually" data.