Person holding a smartphone above a laptop, with a padlock icon and a masked password field glowing above the screen.

Every October, the training module goes out: spot the suspicious link, check the sender address. Meanwhile, the intrusions that actually worked this year started with a phone call to someone whose job is to help. The fix is a verification rule, not another module.