It takes just one click. Phishing emails are still the number one way attackers get in. If it looks off, it probably is. Fake invoices, fake links, fake logins. It's all bait and even smart people get tricked. Train staff to spot and report anything suspicious.