[devmor]

100%

The majority of corporate breaches are a combination of poor Least Privilege practices and phishing/smishing.

Even with well secured, alert personnel, you often see ISPs and Telcos socially engineered to gain access to an employee account.