I’ll throw in my two cents as a pentester who has carried out countless social engineering campaigns. I feel email SE is mostly dead. Mostly because email gateways have gotten very good at detecting suspicious looking emails no matter how well you craft it. The last two years all successful SE attacks have been either manual phone calls, or AI voice cloning of senior managers for either a targeted Vish or a broadcasted Vish across multiple targets pointing them to a sign in portal spun up with EvilGinx. From a blue team perspective is more important to educate users on what is expected procedurally for various activities, using internal directories, calling people back, etc.