Training people to spot phishing is great for culture, but it's a poor safety net; real security means building systems that don't break when someone has a bad day. Organizations have been responding ...