I was friends with a guy in IT and he said the people who failed the phishing tests sent out by them were almost always the executives. Someone got into the CEO’s email and tried to get our controller to wire $100k to some random bank account. Luckily it takes multiple executives to sign off on that kind of transfer out.