习包子 on Nostr: except they also say torture your employees with regular completely pointless ...

except they also say torture your employees with regular completely pointless phishing simulations to make sure a. they know its all their fault and b. to soften them up for actual decent phish attempts. NIST could have written this a decade ago. I'm sure ransomware crews read this and immediately think "damn they are on to us! what are we going to do?? we'll really have to up our game now..." before dying of laughter.