An engineer troubleshooting a failed build may be asked to inspect a log, install a utility, join a repository or provide a temporary credential. Each action can be legitimate. Each can also cross a security boundary. Knowing how software works does not remove the need to verify who requested an action, what access it grants and where the information will go. Training for engineers should begin with those decisions. A general introduction to phishing can provide common language, but practical learning needs to reflect the tools, privileges and time pressures of the role. The aim is to help someone continue useful work while recognizing when the task requires a different route or another person's review. Identify decisions with meaningful consequences Ask engineering managers to describe or ...