Arranging phishing training for employees and ensuring engagement and participation is an HR responsibility that often gets ignored.