Conducting security awareness training is the best action to take to plan for this kind of attack in the future. This approach addresses the root cause by educating employees on how to recognize and avoid phishing attempts, which are a common method used to gain access to corporate mailboxes. While scanning for vulnerabilities and hardening servers are important, they do not address the human factor, which is critical in preventing such attacks. Auditing password complexity is also useful but insufficient on its own to prevent sophisticated phishing attacks. Awareness training provides employees with the necessary knowledge to safeguard themselves and the organization from these types of threats.