How can we reduce repeated phishing incidents when users keep surrendering credentials and MFA codes?

Treat this primarily as an identity-control problem, not just a training problem. Move users to phishing-resistant MFA such as FIDO2 security keys or passkeys. Adversary-in-the-middle kits can relay a password and ordinary MFA codes or push approvals in real time, but passkeys are tied to the legitimate domain. Also block legacy authentication, revoke active sessions after a compromise, restrict risky OAuth grants, and alert on suspicious mailbox rules and sign-ins.

Conditional access can make stolen credentials much less useful. Require sign-ins from enrolled or hybrid-managed devices, limit what personally owned devices can access, and apply stricter policies to higher-risk accounts. If management cannot require managed devices for everyone, even protecting administrative accounts and sensitive applications this way is a major improvement.

There has to be an organizational response too, but it should be documented and applied fairly rather than simply blaming employees. Use realistic simulations, require follow-up training after failures, and send repeat failures through management and HR. If suspension or termination is not realistic in a public-sector environment, consider additional protections for repeat-risk accounts, such as more restrictive access, mandatory hardware-backed MFA, and closer monitoring. Leadership needs to understand the cost of repeated incidents and approve the controls.

You still need a good mail-defense layer. Improve filtering and configure SPF, DKIM, and DMARC appropriately, while allowing legitimate messages from parents and outside organizations. A report-phishing button with a fast human or automated response helps users get suspicious messages reviewed before they click, and automated removal of known malicious messages can prevent compromised accounts from spreading them.