Why It Matters
It started with one email.
An employee at a mid-sized firm opened an invoice PDF that looked like it came from a known vendor. Ten minutes later, an attacker had a foothold on their laptop. Six hours later, they'd moved sideways into the file server — because a service account still had its default password, and nobody had ever tested it.
By the time anyone noticed, the backups had already been touched. Nothing about the attack was clever. It just went unchecked.
This is exactly why technical testing and phishing simulation & awareness training run together, not separately — most breaches start with a person, not a firewall.
