An organization has been the victim of a series of successful phishing attacks targeting i employees. Which of the following factors increases the risk of this situation the most?

lack of email filtering controls

poor password management practices among employees

outdated antivirus software on employee devices

inadequate firewall protection on the network