A financial firm took 1,800 Dridex-laced emails in one campaign. Filters stopped 1,750. Of the 50 that reached inboxes, 14 were clicked; the one infection was detected and cleaned within hours. As the NCSC notes, no single layer would have caught all of it. The guidance is just as blunt about phishing simulations. No training teaches users to spot every attempt, and punishing people for clicking an email you sent them starts to resemble entrapment. If the celebrated metric is a falling click rate, people learn to keep quiet. Measure how many reported, not just how many clicked. https://www.ncsc.gov.uk/guidance/phishing #CyberSecurity #InfoSec #Phishing