I report suspected phishing emails… And meeting requests with links from people I don’t know, and culture surveys with external links, and ‘subscription’ emails from services used in our stack, any ‘surprise’ email with an attachment… I’ve set up rules that automatically forward emails from specific senders directly to security.

Don’t tell an autist that you want them to be paranoid about phishing unless you’re ready for the consequences.