Scams don't work because they're perfect; they work because people don't look long enough. Five rounds of real attack patterns, such as telling a legitimate sign-in URL from a typosquat, show how exposed your team would be.