Real phishing campaigns and evidence-based defenses

HN people cite it to show even technical users fall for phishing and that hardware security keys are the real fix.

Karla Burnett presents real phishing campaigns run against a Bay Area tech company, including conversion rates and how existing protections were bypassed. She argues for evidence-based techniques to prevent credential phishing, not just mitigate it.