Organizations have traditionally treated phishing emails as a technology problem to be solved with spam filters and secure email gateways.