Gitlab phished its own work-from-home staff, and 1 in 5 fell for it
It's important to note the nature of the failure.<p>Opening a phishing email should not be considered a failure.  The email client is specifically designed to be able to display untrusted mail.<p>Even clicking a hyperlink in a phishing email isn't too bad - web browsers are designed to be able to load untrusted content from the internet safely.<p>It's only entering credentials by hand into a phishing website, or downloading and executing something from a phishing site that is a <i>real</i> failure.<p>IT departments should probably enforce single sign on and use a password alert to prevent a password being typed into a webpage.  They should also prevent downloads of executable files from non-whitelisted origins for most staff.