Start with the measurement, because that is where the money is. A simulation program reports click rate and report rate against a template library. When those templates carry deliberate spelling and grammar errors, the trend line records how staff respond to one specific cue. Replace the library with fluent, personalized mail and the number moves for reasons that have nothing to do with employee behaviour or with any control you changed. That break in the line is itself the finding. Somebody has to say so to whoever has been reading the year-over-year slide.
The verification advice is cheap to say and not cheap to run. The column's worked example is an employee who gets a payment request that appears to come from their manager, and the escape is a phone call to the manager rather than a reply to the message [10]. That call only exists if the employee already holds a number that did not arrive in the email [9]. Same problem with "requests that break established business workflows" [7]: a workflow has to be written down before anyone can notice it being broken, so a vendor changing bank details is only a red flag where a documented bank-change procedure exists. The deliverable is a known-good contact directory and an approval path. The training deck is the inexpensive part of this.
The claim is also checkable in-house, which matters more than the percentage. Pull the mail your own users reported last quarter and compare it against the templates your simulation vendor ships. If the reported corpus still carries the clumsy phrasing your library imitates, the library is not stale yet for your mail flow. If it does not, your baseline is already measuring a cue your users no longer see. That comparison takes an afternoon and answers the question for your organisation specifically, which no external figure does.
Rate the document for what it is: an SC Media Perspectives column, written by a member of that publication's contributor community [12]. There is no CVE here, and no named actor or dated campaign attached. Nothing in this piece has to be closed by Friday. What is under review is a twenty-year training habit that the author says taught people to spot phishing through bad grammar, awkward phrasing and clumsy translation [6]. The habit is durable because it was easy to teach and easy to test. Both of those properties are what make it expensive to retire.
