Being able to recognize the common traits of phishing messages through the use of phishing simulations is not enough. Establishing a strong security culture is better. Organizations that prioritise human behavior risk are best positioned to stay resilient against these type of attacks.