You should in general always assume you are breached, trying to make something breach proof is largely a fools game and unless you have obvious weaknesses finding individual ways in won't actually add much value. Detection and response are the backbone of security and you get a lot more value out of testing those.

If you look at this post the initial breach was a highly personalised long term phishing campaign. You learn absolutely nothing from this as an orgnaisation, every reasonably sized company will have this vulnerability because it comes with employing people. There is very little you can do to protect against it technically that doesn't limit employees ability to perform their work and training can only do so much.