Every October, the training module goes out: spot the suspicious link, check the sender address. Meanwhile, the intrusions that actually worked this year started with a phone call to someone whose job is to help. The fix is a verification rule, not another module.