I have to disagree with the premise that security testing should be a “feel-good” exercise. In a healthcare setting, the security team operates as an internal auditor. Their job isn’t to be liked; it is to protect patient lives from catastrophic ransomware attacks that shut down life-saving systems.

To do that effectively, they have an obligation to run real-world simulations. Actual threat actors don’t care about hospital morale or their exploitation under capitalism and they will exploit those exact pressure points to gain credentials. What this test revealed isn’t just that the staff are tired, but that a highly enticing lure easily bypasses their current social controls. Because of this test, the security team now knows they must rely heavier on technical controls (like hardware keys or stricter zero-trust policies) to compensate which is actionable. Being mad at the security team for exposing a fatal vulnerability is shooting the messenger.

yeah but that is exactly the kind of thing a threat actor will use to gain access to critical systems and private health data. It was a textbook scam coming from a clearly fake domain name and they clicked it and put in their credentials, credentials that take down hospital systems and kill people when they don’t operate.

Fortinet are sold by bottom rung MSPs who don’t give a fuck and are totally fine with deploying a swiss cheese firewall

You can track the changes on its github https://github.com/microsoftdocs

Probably true, I have no desire to change my habits of 20 years now lol

I started with Debian and XFCE and I still use Debian and XFCE lol

AzurEEE

To be fair… Chrome is a lateral move on Windows. If I were forced to use Windows I’d probably just use edge if I needed a chromium browser lol

Yeah, 1998 was definitely a time where Microsoft wasn’t going to do that. They were (and are) in embrace, extend, extinguish mode

the operating system should provide basic browser functionalit

Microsoft got literally sued and almost dissolved as a company for that