If a single click on a phishing email can ruin the entire company, the blame doesn’t lie with that individual.