<p>It also is important for your employees. Many employees may know security is important, but they do not know the extent of the damage that is possible. </p><p>Many orgs try to educate their employees, but many do not get the message. Most people don&#39;t think of the consequences of being compromised - either because they don&#39;t know how the org is set up in terms of IT or they do not care. And why should they, it&#39;s not their job to know about security. </p><p>You can see that the types of training we currently deliver either backfire or just do not show any measurable improvement in security behaviour past 3 weeks or so.<br />Even worse for &quot;embedded training&quot;, that landing page that opens after you click on a simulated phishing link. Most people I&#39;ve talked to receiving these (granted, anecdotal evidence) think of it as a neat little game. Never have I heard &quot;oh I learned from this&quot;. It&#39;s usually something along &quot;Oh I clicked it again, yikes&quot;. </p><p>That&#39;s not good. </p><p>So yeah, scams are bad, but they hurt way less than losing your org. And your people usually can imagine the damage of scams, but they cannot imagine the damage phishing can do. </p><p>Don&#39;t conflate scams and <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="tag">#<span>phishing</span></a>.</p><p>3/3</p>