Its also not about the individual. The company is doing an assessment of their security and vulnerabilities. If your company has any sort of restrictions on email attachments or methods of sharing files, theyre probably a result of people failing these tests