What workplace vulnerabilities must we identify to prevent phishing?