Trying to protect staff from clicking on and entering their details on what is quite frankly, low quality phishing emails, is like trying to herd lemmings.