I find it hard to believe that an infosec professional would click a link in an email. Anybody who has ever run an phishing campaign as part of a pentest wouldn

I find it hard to believe that an infosec professional would click a link in an email. Anybody who has ever run an phishing campaign as part of a pentest wouldn't. I only moonlight in the infosec industry, but I know that the Right Thing, upon receiving an unsolicited notification email from a website ("Friend" request, LinkedIn connection requests, "Track a package", etc) is to visit the site in your browser manually, versus clicking some link in an email that could likely be bogus.