Gitlab phished its own work-from-home staff, and 1 in 5 fell for it
It's important to note the nature of the failure.Opening a phishing email should not be considered a failure.  The email client is specifically designed to be able to display untrusted mail.Even clicking a hyperlink in a phishing email isn't too bad - web browsers are designed to be able to load untrusted content from the internet safely.It's only entering credentials by hand into a phishing website, or downloading and executing something from a phishing site that is a real failure.IT departments should probably enforce single sign on and use a password alert to prevent a password being typed into a webpage.  They should also prevent downloads of executable files from non-whitelisted origins for most staff.