540
Phishing
(feddit.org)
If a single click on a phishing email can ruin the entire company, the blame doesn't lie with that individual.
You're forgetting all the hardening in the middle to prevent the privilege escalation that would enable mass deployment of ransomware.