[unionpivo]

Maybe on individual level but on organisation level it's one of the biggest current attack vectors.

And there is no magic bullet. Trying to educate people gives some results, but mostly just prevents low effort phishing attack.

I have never seen pentest that include social engineering fail. (This might be just our customers. I would expect govt or infrastructure organization to be better)